Lucene search

[email protected]CVE-2022-22999

HistoryJul 25, 2022 - 7:15 p.m.

CVE-2022-22999

2022-07-2519:15:28

CWE-79

[email protected]

web.nvd.nist.gov

cve-2022-22999

western digital

my cloud

cross side scripting

vulnerability

javascript

authenticated user

data theft

session hijacking

malicious websites

component vulnerability

8.2 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.9%

JSON

Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user with elevated privileges access to drives being backed up to construct and inject JavaScript payloads into an authenticated user’s browser. As a result, it may be possible to gain control over the authenticated session, steal data, modify settings, or redirect the user to malicious websites. The scope of impact can extend to other components.

Affected configurations

NVD

Node

westerndigitalmy_cloud_pr2100_firmwareRange<5.23.114

AND

westerndigitalmy_cloud_pr2100Match-

Node

westerndigitalmy_cloud_pr4100_firmwareRange<5.23.114

AND

westerndigitalmy_cloud_pr4100Match-

Node

westerndigitalmy_cloud_ex4100_firmwareRange<5.23.114

AND

westerndigitalmy_cloud_ex4100Match-

Node

westerndigitalmy_cloud_ex2_ultra_firmwareRange<5.23.114

AND

westerndigitalmy_cloud_ex2_ultraMatch-

Node

westerndigitalmy_cloud_mirror_g2_firmwareRange<5.23.114

AND

westerndigitalmy_cloud_mirror_g2Match-

Node

westerndigitalmy_cloud_dl2100_firmwareRange<5.23.114

AND

westerndigitalmy_cloud_dl2100Match-

Node

westerndigitalmy_cloud_dl4100_firmwareRange<5.23.114

AND

westerndigitalmy_cloud_dl4100Match-

Node

westerndigitalmy_cloud_ex2100_firmwareRange<5.23.114

AND

westerndigitalmy_cloud_ex2100Match-

CPENameOperatorVersion
westerndigital:my_cloud_pr2100_firmwarewesterndigital my cloud pr2100 firmwarelt5.23.114

CPE	Name	Operator	Version
westerndigital:my_cloud_pr2100_firmware	westerndigital my cloud pr2100 firmware	lt	5.23.114

CNA Affected

[
  {
    "platforms": [
      "Linux"
    ],
    "product": "My Cloud",
    "vendor": "Western Digital",
    "versions": [
      {
        "lessThan": "5.23.114",
        "status": "affected",
        "version": "My Cloud OS 5",
        "versionType": "custom"
      }
    ]
  }
]

References

www.westerndigital.com/support/product-security/wdc-22011-my-cloud-firmware-version-5-23-114

Social References

8.2 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.9%

JSON

Related for CVE-2022-22999

nvd1 cvelist1 prion1 openvas1