CVE-2022-22993 - Limited Server-Side Request Forgery vulnerability on Western Digital My Cloud devices.

Back Back to CVE browser

HIGH

Limited Server-Side Request Forgery vulnerability on Western Digital My Cloud devices.

Published Jan 28, 2022

8.8

HIGH

CVSS 3.1

EPSS 0.76%

Description

A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the server by bypassing access controls. The vulnerability was addressed by creating a whitelist for valid parameters.

Affected products

Vendor Western Digital Product My Cloud Default
n/a
- Version
  My Cloud OS 5
  Status
  affected
  Constraints
  <5.19.117

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Western Digital

My Cloud

n/a

Version	Status	Constraints
My Cloud OS 5	affected	<5.19.117

Remediation

Vendor solution

Update your My Cloud device to firmware version 5.19.117.

Weaknesses (1)

CWE-918

SSRF

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-28104
Advisory
https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117
x_refsource_MISCVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-348/
x_refsource_MISCThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-28104		Advisory
https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117		x_refsource_MISCVendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-348/		x_refsource_MISCThird Party AdvisoryVDB Entry