CVE-2017-18044

A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6. A certain message parsing function inside the Commvault service does not properly validate the input of an incoming string before passing it to CreateProcess. As a result, a specially crafted message can inject commands that will be executed on the target operating system. Exploitation of this vulnerability does not require authentication and can lead to SYSTEM level privilege on any system running the cvd daemon. This is a different vulnerability than CVE-2017-3195.

• CWE-78

• https://github.com/rapid7/metasploit-framework/pull/9340Exploit, Third Party Advisory
• https://github.com/rapid7/metasploit-framework/pull/9389Third Party Advisory
• https://www.securifera.com/advisories/sec-2017-0001/Third Party Advisory
• https://github.com/rapid7/metasploit-framework/pull/9340Exploit, Third Party Advisory
• https://github.com/rapid7/metasploit-framework/pull/9389Third Party Advisory
• https://www.securifera.com/advisories/sec-2017-0001/Third Party Advisory

Published

Jan 19, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-18038The repository settings resource in Atlassian Bitbucket Serv…
• CVE-2017-18039The IncomingMailServers resource in Atlassian Jira from vers…
• CVE-2017-18040The viewDeploymentVersionCommits resource in Atlassian Bambo…
• CVE-2017-18041The viewDeploymentVersionJiraIssuesDialog resource in Atlass…
• CVE-2017-18042The update user administration resource in Atlassian Bamboo …
• CVE-2017-18043Integer overflow in the macro ROUND_UP (n, d) in Quick Emula…
• CVE-2017-18045JBMC DirectAdmin before 1.52, when the email_ftp_password_ch…
• CVE-2017-18046Buffer overflow on Dasan GPON ONT WiFi Router H640X 12.02-01…
• CVE-2017-18047Buffer Overflow in the FTP client in LabF nfsAxe 3.7 allows …
• CVE-2017-18048Monstra CMS 3.0.4 allows users to upload arbitrary files, wh…
• CVE-2017-18049In the CSV export feature of SilverStripe before 3.5.6, 3.6.…
• CVE-2017-18050In Android for MSM, Firefox OS for MSM, QRD Android, with al…