8.8

CVE-2022-22990

Limited authentication bypass vulnerability on Western Digital My Cloud devices

A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Westerndigital ≫ My Cloud Os Version < 5.19.117
   Westerndigital ≫ My Cloud Version -
   Westerndigital ≫ My Cloud Dl2100 Version -
   Westerndigital ≫ My Cloud Dl4100 Version -
   Westerndigital ≫ My Cloud Ex2 Ultra Version -
   Westerndigital ≫ My Cloud Ex2100 Version -
   Westerndigital ≫ My Cloud Ex4100 Version -
   Westerndigital ≫ My Cloud Mirror Gen 2 Version -
   Westerndigital ≫ My Cloud Pr2100 Version -
   Westerndigital ≫ My Cloud Pr4100 Version -
   Westerndigital ≫ Wd Cloud Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.12% 0.795
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 8.3 6.5 10
AV:A/AC:L/Au:N/C:C/I:C/A:C
psirt@wdc.com 7.8 1.4 5.8
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

CWE-697 Incorrect Comparison

The product compares two entities in a security-relevant context, but the comparison is incorrect.

https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-076/
Third Party Advisory
VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-347/
Third Party Advisory
VDB Entry