Versio.io

CVE-2022-22990

Common vulnerabilities & exposures (CVE)

CVE databaseCVE database blogpostRelease & EoL database
 
Published at: - 13-01-2022 10:15
Last modified: - 17-03-2022 06:57
Total changes: - 6

Description

A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Low
Attack complexity
Adjacent
Attack vector
High
Availability
High
Confidentiality
High
Integrity
None
Privileges required
Unchanged
Scope
None
User interaction
8.8
Base score
2.8
5.9
Exploitability score
Impact score
 

Verification logic

AND
OR
vendor=westerndigital AND product=my_cloud_os AND versionEndExcluding=5.19.117
OR
vendor=westerndigital AND product=my_cloud AND version=-
vendor=westerndigital AND product=my_cloud_dl2100 AND version=-
vendor=westerndigital AND product=my_cloud_dl4100 AND version=-
vendor=westerndigital AND product=my_cloud_ex2100 AND version=-
vendor=westerndigital AND product=my_cloud_ex2_ultra AND version=-
vendor=westerndigital AND product=my_cloud_ex4100 AND version=-
vendor=westerndigital AND product=my_cloud_mirror_gen_2 AND version=-
vendor=westerndigital AND product=my_cloud_pr2100 AND version=-
vendor=westerndigital AND product=my_cloud_pr4100 AND version=-
vendor=westerndigital AND product=wd_cloud AND version=-
 

Reference

 


Keywords

NVD

 

CVE-2022-22990

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures

 

We use cookies to ensure that we give you the best experience on our website. Read privacy policies for more information.