CVE-2022-36328

Katalog CVE

CVSS 4.9 · Medium EPSS 0,77%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada westerndigital my cloud os 5, westerndigital my cloud home firmware +2 lainnya. Skor CVSS 3.1 4.9 (Medium) menurut NVD.

Deskripsi (NVD)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to create arbitrary shares on arbitrary directories and exfiltrate sensitive files, passwords, users and device configurations was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This can only be exploited once an attacker gains root privileges on the devices using an authentication bypass issue or another vulnerability.This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191; My Cloud OS 5: before 5.26.202.

Rincian

Terbit di NVD

18 Mei 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,77% peluang dieksploitasi; lebih tinggi dari 54,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.westerndigital.com/support/product-security/wdc-23003-western-digital-my-cloud-home-my-cloud-home-... release notes · advisory vendor
• https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmware-version-5-26-202 release notes · advisory vendor