CVE-2020-25780

published 2020-10-29

CVE-2020-25780: In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, Directory Traversal can occur such that…

Priority P2 59 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, Directory Traversal can occur such that an attempt to view a log file can instead view a file outside of the log-files folder.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
commvault	commcell	< 14.68	14.68
commvault	commcell	>= 15.0 < 15.58	15.58
commvault	commcell	>= 16.0 < 16.44	16.44
commvault	commcell	>= 17.0 < 17.29	17.29
commvault	commcell	>= 18.0 < 18.13	18.13

Detection & IOCs extracted from sources · hover to see the quote

url /SearchSvc/CVSearchService.svc↗

other soapaction: http://tempuri.org/ICVSearchSvc/downLoadFile↗

path c:/Windows/system.ini↗

• → Detect exploitation attempts by monitoring POST requests to /SearchSvc/CVSearchService.svc with the SOAPAction header set to http://tempuri.org/ICVSearchSvc/downLoadFile and a body containing path traversal sequences (e.g., '../' or absolute paths like 'c:/Windows/system.ini'). ↗
• → A successful exploitation response will return HTTP 200 and contain the string 'downLoadFileResult' in the response body. ↗

• · Vulnerable versions span multiple major release branches; ensure version checks cover all affected ranges before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13. ↗

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22