vulnwire
9.8crit

CVE-2017-3195in critical feed1 exploit

Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overf…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
21.4%
percentile 98%
Public exploits
1
Exploit-DB

Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overflow vulnerability that could lead to arbitrary code execution with administrative privileges.

Exploit prediction (EPSS)

21.39% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

Exploits and detections

  • EDB-41823 CommVault Edge 11 SP6 - Stack Buffer Overflow (PoC) · dos · 2017-03-16

CVSS scores

Assigned byVersionScoreVector
NVD3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • Commvault Service Pack 6

Classification

Weakness
  • CWE-121 Stack-based Buffer Overflow
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

  • kb.commvault.com /article/SEC0013 · x_refsource_CONFIRM, x_transferred
  • redr2e.com /commvault-edge-cve-2017-3195/ · x_refsource_MISC, x_transferred
  • exploit-db.com /exploits/41823/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • kb.cert.org /vuls/id/214283 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • securityfocus.com /bid/96941 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.