Commvault up to 11.36.14 on Windows Installation uncontrolled search path

Summaryinfo

A vulnerability was found in Commvault up to 11.20.201/11.28.123/11.32.64/11.34.36/11.36.14 on Windows and classified as problematic. The impacted element is an unknown function of the component Installation. Such manipulation leads to uncontrolled search path. This vulnerability is referenced as CVE-2024-13976. The attack can only be performed from a local environment. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Commvault up to 11.20.201/11.28.123/11.32.64/11.34.36/11.36.14 on Windows. Affected by this issue is an unknown code of the component Installation. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. Using CWE to declare the problem leads to CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A DLL injection vulnerability exists in Commvault for Windows 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. During the installation of maintenance updates, an attacker with local access may exploit uncontrolled search path or DLL loading behavior to execute arbitrary code with elevated privileges. The vulnerability has been resolved in versions 11.20.202, 11.28.124, 11.32.65, 11.34.37, and 11.36.15.

The advisory is shared for download at documentation.commvault.com. This vulnerability is handled as CVE-2024-13976 since 07/23/2025. The exploitation is known to be difficult. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1574.

Upgrading to version 11.20.202, 11.28.124, 11.32.65, 11.34.37 or 11.36.15 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2024-54818). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Commvault

Version

• 11.20.201
• 11.28.123
• 11.32.0
• 11.32.1
• 11.32.2
• 11.32.3
• 11.32.4
• 11.32.5
• 11.32.6
• 11.32.7
• 11.32.8
• 11.32.9
• 11.32.10
• 11.32.11
• 11.32.12
• 11.32.13
• 11.32.14
• 11.32.15
• 11.32.16
• 11.32.17
• 11.32.18
• 11.32.19
• 11.32.20
• 11.32.21
• 11.32.22
• 11.32.23
• 11.32.24
• 11.32.25
• 11.32.26
• 11.32.27
• 11.32.28
• 11.32.29
• 11.32.30
• 11.32.31
• 11.32.32
• 11.32.33
• 11.32.34
• 11.32.35
• 11.32.36
• 11.32.37
• 11.32.38
• 11.32.39
• 11.32.40
• 11.32.41
• 11.32.42
• 11.32.43
• 11.32.44
• 11.32.45
• 11.32.46
• 11.32.47
• 11.32.48
• 11.32.49
• 11.32.50
• 11.32.51
• 11.32.52
• 11.32.53
• 11.32.54
• 11.32.55
• 11.32.56
• 11.32.57
• 11.32.58
• 11.32.59
• 11.32.60
• 11.32.61
• 11.32.62
• 11.32.63
• 11.32.64
• 11.34.0
• 11.34.1
• 11.34.2
• 11.34.3
• 11.34.4
• 11.34.5
• 11.34.6
• 11.34.7
• 11.34.8
• 11.34.9
• 11.34.10
• 11.34.11
• 11.34.12
• 11.34.13
• 11.34.14
• 11.34.15
• 11.34.16
• 11.34.17
• 11.34.18
• 11.34.19
• 11.34.20
• 11.34.21
• 11.34.22
• 11.34.23
• 11.34.24
• 11.34.25
• 11.34.26
• 11.34.27
• 11.34.28
• 11.34.29
• 11.34.30
• 11.34.31
• 11.34.32
• 11.34.33
• 11.34.34
• 11.34.35
• 11.34.36
• 11.36.0
• 11.36.1
• 11.36.2
• 11.36.3
• 11.36.4
• 11.36.5
• 11.36.6
• 11.36.7
• 11.36.8
• 11.36.9
• 11.36.10
• 11.36.11
• 11.36.12
• 11.36.13
• 11.36.14

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion