nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2022-22993 CVE-2022-22993
HIGH
Limited Server-Side Request Forgery vulnerability on Western Digital My Cloud devices.
Record summary
CVE-2022-22993 has a selected CVSS score of 7.8 (high).
Description
A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the server by bypassing access controls. The vulnerability was addressed by creating a whitelist for valid parameters.
Description source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
| CVE List | My Cloud OS 5 to < 5.19.117 | affected |
References
3westerndigital.com
https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117 zerodayinitiative.com
https://www.zerodayinitiative.com/advisories/ZDI-22-348