CVE-2022-22993CWE-918

Limited Server-Side Request Forgery vulnerability on Western Digital My Cloud devices.

High · published January 28, 2022

CVSS v3.1
7.8
EPSS
1%
Percentile
54.7
In the wild
Unconfirmed
What it is

A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the server by bypassing access controls. The vulnerability was addressed by creating a whitelist for valid parameters.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00758 · 54.7th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2022-01-28T19:09Z
EPSS history
Timeline
  • 28 JAN 19:09Z
    Limited Server-Side Request Forgery vulnerability on Western Digital My Cloud devices.
    cvelistv5