CVE-2022-22999: falha de alta gravidade em Western Digital My Cloud
Cross-site Scripting Vulnerability in USB Backups App
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.4%
Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user with elevated privileges access to drives being backed up to construct and inject JavaScript payloads into an authenticated user's browser. As a result, it may be possible to gain control over the authenticated session, steal data, modify settings, or redirect the user to malicious websites. The scope of impact can extend to other components.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
Western Digital · My CloudCVEs relacionadas — Western Digital My Cloud
No mesmo produto, das mais perigosas para as menos.
CVE-2022-29844MEDIUMWestern Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftpEPSS 36.4%CVE-2022-22995CRITICALWestern Digital My Cloud OS 5 and My Cloud Home Unauthenticated Arbitrary File Write Vulnerability in NetatalkEPSS 2.7%CVE-2022-22990HIGHLimited authentication bypass vulnerability on Western Digital My Cloud devicesEPSS 2.2%CVE-2022-22994HIGHInsufficient Verification of Data Authenticity Remote Code Execution Vulnerability on Western Digital My Cloud devices.EPSS 1.9%CVE-2022-22989CRITICALPre-authenticated stack overflow vulnerability on FTP ServiceEPSS 1.4%CVE-2022-22991HIGHCommand injection through unsecured HTTP calls on Western Digital My Cloud devicesEPSS 1.3%