Limited authentication bypass vulnerability on Western Digital My Cloud devices (Western Digital My Cloud)
At a glance
- Source
- NVD
- EPSS
- EPSS 2.12 % · percentile 82 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- WDC PSIRT
- NVD status
- Modified
Description
A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts.
Weaknesses (CWE)
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N | WDC PSIRT |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N | NVD · psirt@wdc.com (Secondary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 8.3 | AV:A/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2022-28101
- GCVE · GCVE-0-2022-22990
Affected configurations (NVD CPE)
cpe:2.3:o:westerndigital:my_cloud_os:*:*:*:*:*:*:*:*< 5.19.117
Affected products
| Product | Versions |
|---|---|
| Western Digital · My Cloud | affected My Cloud OS 5 < 5.19.117 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |