PT-2022-4256 · Western Digital · Western Digital My Cloud Web App

Published 2022-07-25 · Updated 2022-08-03 · CVE-2022-23000

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud Web App (affected versions not specified)

Description The issue is related to the use of a weak SSLContext in the Western Digital My Cloud Web App when configuring port forwarding rules. This weakness is due to the use of an "SSL" context instead of "TLS" or stronger validation, allowing deprecated or insecure protocols. As a result, a local user without privileges can exploit this weakness, potentially compromising the integrity, confidentiality, and authenticity of transmitted information. The impact is limited to this component, and no user input is required for exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-757

Related Identifiers

BDU:2022-05106

CVE-2022-23000

Affected Products

Western Digital My Cloud Web App

References · 5

• https://bdu.fstec.ru/vul/2022-05106 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-23000 · Security Note
• https://westerndigital.com/support/product-security/wdc-22011-my-cloud-firmware-version-5-23-114 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23000 · Vendor Advisory
• https://t.me/cibsecurity/46955 · Telegram Post