Commvault up to 11.32.59/11.34.33/11.36.7 on Windows privileges management

Summaryinfo

A vulnerability has been found in Commvault up to 11.32.59/11.34.33/11.36.7 on Windows and classified as critical. The affected element is an unknown function. This manipulation causes privileges management. The identification of this vulnerability is CVE-2024-13975. The attack can only be executed locally. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical was found in Commvault up to 11.32.59/11.34.33/11.36.7 on Windows. Affected by this vulnerability is an unknown part. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A local privilege escalation vulnerability exists in Commvault for Windows versions 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. In affected configurations, a local attacker who owns a client system with the file server agent installed can compromise any assigned Windows access nodes. This may allow unauthorized access or lateral movement within the backup infrastructure. The issue has been resolved in versions 11.32.60, 11.34.34, and 11.36.8.

It is possible to read the advisory at documentation.commvault.com. This vulnerability is known as CVE-2024-13975 since 07/23/2025. The exploitation appears to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 11.32.60, 11.34.34 or 11.36.8 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2024-54819). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Commvault

Version

• 11.32.0
• 11.32.1
• 11.32.2
• 11.32.3
• 11.32.4
• 11.32.5
• 11.32.6
• 11.32.7
• 11.32.8
• 11.32.9
• 11.32.10
• 11.32.11
• 11.32.12
• 11.32.13
• 11.32.14
• 11.32.15
• 11.32.16
• 11.32.17
• 11.32.18
• 11.32.19
• 11.32.20
• 11.32.21
• 11.32.22
• 11.32.23
• 11.32.24
• 11.32.25
• 11.32.26
• 11.32.27
• 11.32.28
• 11.32.29
• 11.32.30
• 11.32.31
• 11.32.32
• 11.32.33
• 11.32.34
• 11.32.35
• 11.32.36
• 11.32.37
• 11.32.38
• 11.32.39
• 11.32.40
• 11.32.41
• 11.32.42
• 11.32.43
• 11.32.44
• 11.32.45
• 11.32.46
• 11.32.47
• 11.32.48
• 11.32.49
• 11.32.50
• 11.32.51
• 11.32.52
• 11.32.53
• 11.32.54
• 11.32.55
• 11.32.56
• 11.32.57
• 11.32.58
• 11.32.59
• 11.34.0
• 11.34.1
• 11.34.2
• 11.34.3
• 11.34.4
• 11.34.5
• 11.34.6
• 11.34.7
• 11.34.8
• 11.34.9
• 11.34.10
• 11.34.11
• 11.34.12
• 11.34.13
• 11.34.14
• 11.34.15
• 11.34.16
• 11.34.17
• 11.34.18
• 11.34.19
• 11.34.20
• 11.34.21
• 11.34.22
• 11.34.23
• 11.34.24
• 11.34.25
• 11.34.26
• 11.34.27
• 11.34.28
• 11.34.29
• 11.34.30
• 11.34.31
• 11.34.32
• 11.34.33
• 11.36.0
• 11.36.1
• 11.36.2
• 11.36.3
• 11.36.4
• 11.36.5
• 11.36.6
• 11.36.7

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion