CVE-2022-22993
HIGHWestern Digital My Cloud OS < 5.19.117 - Server-Side Request Forgery via Parameter Whitelist Bypass
Title source: llmDescription
A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the server by bypassing access controls. The vulnerability was addressed by creating a whitelist for valid parameters.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_misc
https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117
Third Party Advisory, VDB Entry x_refsource_misc
https://www.zerodayinitiative.com/advisories/ZDI-22-348/
Scores
CVSS v3
7.8
EPSS
0.0076
EPSS Percentile
50.5%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Details
CWE
CWE-918
Status
published
Products (1)
westerndigital/my_cloud_os
< 5.19.117
Published
Jan 28, 2022
Tracked Since
Feb 18, 2026