CVE-2022-22999

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-22999
Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user with elevated privileges access to drives being backed up to construct and inject JavaScript payloads into an authenticated user's browser. As a result, it may be possible to gain control over the authenticated session, steal data, modify settings, or redirect the user to malicious websites. The scope of impact can extend to other components.

4.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://www.westerndigital.com/support/product-security/wdc-22011-my-cloud-firmware-version-5-23-114 Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:westerndigital:my_cloud_pr2100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_pr2100:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:westerndigital:my_cloud_pr4100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_pr4100:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:westerndigital:my_cloud_ex4100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_ex4100:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:westerndigital:my_cloud_ex2_ultra_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_ex2_ultra:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:westerndigital:my_cloud_mirror_g2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_mirror_g2:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:westerndigital:my_cloud_dl2100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_dl2100:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:westerndigital:my_cloud_dl4100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_dl4100:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:westerndigital:my_cloud_ex2100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_ex2100:-:*:*:*:*:*:*:*
History

No history.

Information

Published : 2022-07-25 19:15

Updated : 2024-02-28 19:29

NVD link : CVE-2022-22999

Mitre link : CVE-2022-22999

CVE.ORG link : CVE-2022-22999

JSON object : View

Products Affected

westerndigital

  • my_cloud_dl2100
  • my_cloud_mirror_g2_firmware
  • my_cloud_dl4100_firmware
  • my_cloud_ex4100
  • my_cloud_ex2_ultra_firmware
  • my_cloud_pr4100
  • my_cloud_ex2_ultra
  • my_cloud_dl2100_firmware
  • my_cloud_mirror_g2
  • my_cloud_pr4100_firmware
  • my_cloud_ex4100_firmware
  • my_cloud_pr2100
  • my_cloud_ex2100_firmware
  • my_cloud_ex2100
  • my_cloud_pr2100_firmware
  • my_cloud_dl4100
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')