CVE-2017-18044

A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6. A certain message parsing function inside the Commvault service does not properly validate the input of an incoming string before passing it to CreateProcess. As a result, a specially crafted...

CVE-2017-18044

CVE-2017-18044 is a command injection vulnerability in Commvault's ContentStore/Base/CVDataPipe.dll. The issue arises from a message parsing function that passes unchecked input to CreateProcess, enabling a remote attacker to inject and execute commands on the target OS. The flaw is exploitable w...