PT-2022-15763 · Western Digital · Western Digital My Cloud

S_N_T + 1 · Published 2022-01-28 · Updated 2022-03-18 · CVE-2022-22993

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud devices (affected versions not specified)

Description A limited Server-Side Request Forgery (SSRF) issue was discovered, allowing an attacker to impersonate a server, bypass access controls, and reach any page on the server. The vulnerability was addressed by creating a whitelist for valid parameters.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-22993

ZDI-22-348

Affected Products

Western Digital My Cloud

References · 6

• https://zerodayinitiative.com/advisories/ZDI-22-348 · Security Note
• https://westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22993 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22993 · Security Note
• https://t.me/cvenotify/26814 · Telegram Post
• https://t.me/cibsecurity/36498 · Telegram Post