CVE-2022-29840CWE-918

Server Side Request Forgery Vulnerability in Western Digital My Cloud Devices

Medium · published May 10, 2023

CVSS v3.1
5.1
EPSS
0%
Percentile
3.2
In the wild
Unconfirmed
What it is

Server-Side Request Forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL to point back to the loopback adapter was addressed in Western Digital My Cloud OS 5 devices. This could allow the URL to exploit other vulnerabilities on the local server.This issue affects My Cloud OS 5 devices before 5.26.202.

The record
Technical detail
CVSS v3.1
5.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00142 · 3.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2023-05-10T22:09Z
EPSS history
Timeline
  • 10 MAY 22:09Z
    Server Side Request Forgery Vulnerability in Western Digital My Cloud Devices
    cvelistv5