## Summary
CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. The Commvault security advisory instructs customers to upgrade to the resolved maintenance release; patching is required for affected versions.
## Technical Details
- Vulnerability type: authorization bypass (CWE-863)
- Scope: limited to a set of command execution operations within CommServe
- Attack vector: NETWORK with no required user interaction (UI:N) and no privileges required (PR:N) per the provided CVSS vector
- Severity: critical (CVSS 9.8 as provided)
## Affected
- Product: Commvault
- Platforms: Linux, Windows
- Affected versions: 11.36.0 - 11.36.114 (exclusive)
- Resolved versions (per advisory):
- 11.44.11 and higher
- 11.46.10 and higher
## Impact
- Authorization bypass enabling command execution operations
- Potential consequences indicated by CVSS: confidentiality impact, integrity impact, and availability impact (all H in the provided vector)
## Mitigation
1. Upgrade all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients, and HyperScale X.
2. Move to a resolved maintenance release as specified in the advisory (e.g., 11.44.11+ or 11.46.10+).
3. For any unsupported versions, follow the advisory guidance to upgrade, as unsupported versions are not guaranteed to be unaffected.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-863