CVE-2025-12776

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12776", "assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333", "state": "PUBLISHED", "assignerShortName": "Commvault", "dateReserved": "2025-11-05T20:18:49.381Z", "datePublished": "2026-01-07T22:03:05.033Z", "dateUpdated": "2026-01-08T18:17:45.215Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "WebConsole", "vendor": "Commvault", "versions": [{"lessThanOrEqual": "11.32.*", "status": "affected", "version": "11.32.0", "versionType": "semver"}, {"lessThanOrEqual": "11.36.*", "status": "affected", "version": "11.36.0", "versionType": "semver"}, {"lessThanOrEqual": "11.40.*", "status": "unaffected", "version": "11.40.1", "versionType": "semver"}, {"lessThanOrEqual": "11.42.*", "status": "unaffected", "version": "11.42.1", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "NCIA researchers"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site Scripting (XSS) attack. Proper management of this functionality helps ensure a secure and seamless user experience. &nbsp;Although the user input is not validated in the report creation, these scripts are not executed when the report is run by end users. The script is executed when the report is modified through the report builder by a user with edit permissions. </div><div><br></div><div>The Report Builder is part of the WebConsole. &nbsp;The WebConsole package is currently end of life, and is no longer maintained. We strongly recommend against installing or using it in any production environment. However, if you choose to install it, for example, to access functionality like the Report Builder, it must be deployed within a fully isolated network that has no access to sensitive data or internet connectivity. This is a critical security precaution, as the retired package may contain unpatched vulnerabilities and is no longer supported with updates or fixes.&nbsp;&nbsp;</div><br><br>"}], "value": "The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site Scripting (XSS) attack. Proper management of this functionality helps ensure a secure and seamless user experience. \u00a0Although the user input is not validated in the report creation, these scripts are not executed when the report is run by end users. The script is executed when the report is modified through the report builder by a user with edit permissions. \n\n\n\n\nThe Report Builder is part of the WebConsole. \u00a0The WebConsole package is currently end of life, and is no longer maintained. We strongly recommend against installing or using it in any production environment. However, if you choose to install it, for example, to access functionality like the Report Builder, it must be deployed within a fully isolated network that has no access to sensitive data or internet connectivity. This is a critical security precaution, as the retired package may contain unpatched vulnerabilities and is no longer supported with updates or fixes."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 1.8, "baseSeverity": "LOW", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333", "shortName": "Commvault", "dateUpdated": "2026-01-07T22:08:14.195Z"}, "references": [{"url": "https://documentation.commvault.com/securityadvisories/CV_2025_06_3.html"}], "source": {"discovery": "UNKNOWN"}, "title": "Stored Cross-Site Scripting", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-08T15:09:42.351651Z", "id": "CVE-2025-12776", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T18:17:45.215Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12776", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-08T15:09:42.351651Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T15:09:44.652Z"}}], "cna": {"title": "Stored Cross-Site Scripting", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "NCIA researchers"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Commvault", "product": "WebConsole", "versions": [{"status": "affected", "version": "11.32.0", "versionType": "semver", "lessThanOrEqual": "11.32.*"}, {"status": "affected", "version": "11.36.0", "versionType": "semver", "lessThanOrEqual": "11.36.*"}, {"status": "unaffected", "version": "11.40.1", "versionType": "semver", "lessThanOrEqual": "11.40.*"}, {"status": "unaffected", "version": "11.42.1", "versionType": "semver", "lessThanOrEqual": "11.42.*"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://documentation.commvault.com/securityadvisories/CV_2025_06_3.html"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site Scripting (XSS) attack. Proper management of this functionality helps ensure a secure and seamless user experience. \u00a0Although the user input is not validated in the report creation, these scripts are not executed when the report is run by end users. The script is executed when the report is modified through the report builder by a user with edit permissions. \n\n\n\n\nThe Report Builder is part of the WebConsole. \u00a0The WebConsole package is currently end of life, and is no longer maintained. We strongly recommend against installing or using it in any production environment. However, if you choose to install it, for example, to access functionality like the Report Builder, it must be deployed within a fully isolated network that has no access to sensitive data or internet connectivity. This is a critical security precaution, as the retired package may contain unpatched vulnerabilities and is no longer supported with updates or fixes.", "supportingMedia": [{"type": "text/html", "value": "<div>The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site Scripting (XSS) attack. Proper management of this functionality helps ensure a secure and seamless user experience. &nbsp;Although the user input is not validated in the report creation, these scripts are not executed when the report is run by end users. The script is executed when the report is modified through the report builder by a user with edit permissions. </div><div><br></div><div>The Report Builder is part of the WebConsole. &nbsp;The WebConsole package is currently end of life, and is no longer maintained. We strongly recommend against installing or using it in any production environment. However, if you choose to install it, for example, to access functionality like the Report Builder, it must be deployed within a fully isolated network that has no access to sensitive data or internet connectivity. This is a critical security precaution, as the retired package may contain unpatched vulnerabilities and is no longer supported with updates or fixes.&nbsp;&nbsp;</div><br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333", "shortName": "Commvault", "dateUpdated": "2026-01-07T22:08:14.195Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12776", "state": "PUBLISHED", "dateUpdated": "2026-01-08T18:17:45.215Z", "dateReserved": "2025-11-05T20:18:49.381Z", "assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333", "datePublished": "2026-01-07T22:03:05.033Z", "assignerShortName": "Commvault"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WebConsole", "vendor": "Commvault", "versions": [{"lessThanOrEqual": "11.32.*", "status": "affected", "version": "11.32.0", "versionType": "semver"}, {"lessThanOrEqual": "11.36.*", "status": "affected", "version": "11.36.0", "versionType": "semver"}, {"lessThanOrEqual": "11.40.*", "status": "unaffected", "version": "11.40.1", "versionType": "semver"}, {"lessThanOrEqual": "11.42.*", "status": "unaffected", "version": "11.42.1", "versionType": "semver"}]}], "source": "050066fd-a2f9-4f32-ab5d-4c53f48bc333"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*", "matchCriteriaId": "C7233436-E60E-4927-8CA1-D47A3B7435E3", "versionEndIncluding": "11.36.68", "versionStartIncluding": "11.36.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*", "matchCriteriaId": "EC4C203B-568A-4AE3-BC8D-38854E3985CE", "versionEndIncluding": "11.32.112", "versionStartIncluding": "11.32.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site Scripting (XSS) attack. Proper management of this functionality helps ensure a secure and seamless user experience. \u00a0Although the user input is not validated in the report creation, these scripts are not executed when the report is run by end users. The script is executed when the report is modified through the report builder by a user with edit permissions. \n\n\n\n\nThe Report Builder is part of the WebConsole. \u00a0The WebConsole package is currently end of life, and is no longer maintained. We strongly recommend against installing or using it in any production environment. However, if you choose to install it, for example, to access functionality like the Report Builder, it must be deployed within a fully isolated network that has no access to sensitive data or internet connectivity. This is a critical security precaution, as the retired package may contain unpatched vulnerabilities and is no longer supported with updates or fixes."}, {"lang": "es", "value": "El componente Report Builder de la aplicaci\u00f3n almacena la entrada del usuario directamente en una p\u00e1gina web y la muestra a otros usuarios, lo que gener\u00f3 preocupaciones sobre un posible ataque de cross-site scripting (XSS). La gesti\u00f3n adecuada de esta funcionalidad ayuda a garantizar una experiencia de usuario segura y sin interrupciones. Aunque la entrada del usuario no se valida en la creaci\u00f3n del informe, estos scripts no se ejecutan cuando el informe es ejecutado por los usuarios finales. El script se ejecuta cuando el informe es modificado a trav\u00e9s del report builder por un usuario con permisos de edici\u00f3n.\n\nEl Report Builder es parte de la WebConsole. El paquete WebConsole se encuentra actualmente en fin de vida \u00fatil y ya no recibe mantenimiento. Desaconsejamos encarecidamente instalarlo o usarlo en cualquier entorno de producci\u00f3n. Sin embargo, si elige instalarlo, por ejemplo, para acceder a funcionalidades como el Report Builder, debe implementarse dentro de una red completamente aislada que no tenga acceso a datos sensibles ni a conectividad a internet. Esta es una precauci\u00f3n de seguridad cr\u00edtica, ya que el paquete retirado puede contener vulnerabilidades sin parchear y ya no recibe soporte con actualizaciones o correcciones."}], "id": "CVE-2025-12776", "lastModified": "2026-06-17T08:32:56.333", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.8, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "050066fd-a2f9-4f32-ab5d-4c53f48bc333", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12776", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-08T15:09:42.351651Z", "version": "2.0.3"}}]}, "published": "2026-01-07T22:15:43.030", "references": [{"source": "050066fd-a2f9-4f32-ab5d-4c53f48bc333", "tags": ["Vendor Advisory"], "url": "https://documentation.commvault.com/securityadvisories/CV_2025_06_3.html"}], "sourceIdentifier": "050066fd-a2f9-4f32-ab5d-4c53f48bc333", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "050066fd-a2f9-4f32-ab5d-4c53f48bc333", "type": "Secondary"}]}

{}

{"created": "2026-01-08T09:48:09.132112+00:00", "updated": "2026-01-08T09:48:09.132150+00:00", "vendors": ["commvault", "commvault$PRODUCT$webconsole"]}