CVE-2017-18044
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2017-18044
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6. A certain message parsing function inside the Commvault service does not properly validate the input of an incoming string before passing it to CreateProcess. As a result, a specially crafted message can inject commands that will be executed on the target operating system. Exploitation of this vulnerability does not require authentication and can lead to SYSTEM level privilege on any system running the cvd daemon. This is a different vulnerability than CVE-2017-3195.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Commvault 命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Commvault是美国Commvault公司的一套基于Simpana（一体化软件平台）为终端用户提供数据自动保护和即时访问等功能的软件。 Commvault 11 SP6之前版本中的ContentStore/Base/CVDataPipe.dll文件存在命令注入漏洞，该漏洞源于在将进入的字符串传递到CreateProcess之前，Commvault服务中的消息解析函数没有正确的验证输入。攻击者可借助特制的消息利用该漏洞在目标操作系统上注入并执行命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
II. Public POCs for CVE-2017-18044
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | Commvault-CVE-2017-18044 | https://github.com/securifera/CVE-2017-18044-Exploit | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2017-18044
请登录查看更多情报信息。
- https://github.com/rapid7/metasploit-framework/pull/9340x_refsource_MISC
- https://github.com/rapid7/metasploit-framework/pull/9389x_refsource_MISC
- https://www.securifera.com/advisories/sec-2017-0001/x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2017-18044
Same Patch Batch · n/a · 2018-01-19 · 8 CVEs total
| CVE-2017-12098 | rails_admin rails gem 跨站脚本漏洞 | |
| CVE-2014-4919 | Oxid Esales OXID eShop 权限许可和访问控制问题漏洞 | |
| CVE-2015-6926 | Oxid Esales OXID eShop 授权问题漏洞 | |
| CVE-2018-5783 | PoDoFo 安全漏洞 | |
| CVE-2018-5784 | Silicon Graphics LibTIFF 安全漏洞 | |
| CVE-2018-5785 | OpenJPEG 数字错误漏洞 | |
| CVE-2018-5786 | Long Range Zip 安全漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2017-18044
No comments yet