CVE-2025-12776
📋 TL;DR
This CVE describes a stored Cross-Site Scripting (XSS) vulnerability in the Report Builder component of WebConsole. Attackers with edit permissions can inject malicious scripts that execute when other users with edit permissions modify reports. The vulnerability affects users of the end-of-life WebConsole package.
💻 Affected Systems
- Commvault WebConsole
📦 What is this software?
Commvault by Commvault
Commvault by Commvault
⚠️ Risk & Real-World Impact
Worst Case
An attacker with edit permissions could inject malicious scripts that execute when other administrators modify reports, potentially leading to session hijacking, credential theft, or further system compromise.
Likely Case
Limited impact since exploitation requires edit permissions and only affects users modifying reports through the Report Builder interface.
If Mitigated
Minimal impact if deployed in isolated network without internet access and with strict access controls limiting edit permissions.
🎯 Exploit Status
Exploitation requires authenticated user with edit permissions. No public exploit code identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: https://documentation.commvault.com/securityadvisories/CV_2025_06_3.html
Restart Required: No
Instructions:
No official patch available as WebConsole is end-of-life. Follow vendor recommendation to avoid using in production.
🔧 Temporary Workarounds
Network Isolation
allDeploy WebConsole in fully isolated network with no internet access or access to sensitive data
Access Control Restriction
allMinimize users with edit permissions to Report Builder component
🧯 If You Can't Patch
- Remove WebConsole from production environments entirely
- Implement strict network segmentation and firewall rules to isolate WebConsole instances
🔍 How to Verify
Check if Vulnerable:
Check if WebConsole package is installed and Report Builder component is enabledCheck Version:
Check package manager or installation logs for WebConsole presenceVerify Fix Applied:
Verify WebConsole has been removed or isolated per security recommendations📡 Detection & Monitoring
Log Indicators:
- Unusual report modifications
- Multiple failed edit attempts
- Suspicious script-like content in report data
Network Indicators:
- Unexpected outbound connections from WebConsole server
- Traffic to/from isolated WebConsole network
SIEM Query:
source="webconsole" AND (event="report_edit" OR event="report_save") AND (data CONTAINS "<script>" OR data CONTAINS "javascript:")