CVE-2022-22993

EUVD-2022-28104
A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the server by bypassing access controls. The vulnerability was addressed by creating a whitelist for valid parameters.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
WDC PSIRTCNA
7.8 HIGH
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 17%
Affected Products (NVD)
VendorProductVersion
westerndigitalmy_cloud_os
𝑥
< 5.19.117
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117
https://www.zerodayinitiative.com/advisories/ZDI-22-348/
https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117
https://www.zerodayinitiative.com/advisories/ZDI-22-348/