Vulnerability in Netatalk
CVE-2022-22995
The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L.
EPSS exploit prediction
EPSS: 0.027 (85.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 86th percentile — 85.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.028 · newest: 0.027 · change: -0.000
Affected products
- Netatalk
- Western Digital My Cloud — versions My Cloud OS 5
- Western Digital My Cloud Home — versions My Cloud Home
- Westerndigital My Cloud
- Westerndigital My Cloud Dl2100
- Westerndigital My Cloud Dl2100 Firmware
- Westerndigital My Cloud Dl4100
- Westerndigital My Cloud Dl4100 Firmware
- Westerndigital My Cloud Ex2100
- Westerndigital My Cloud Ex2100 Firmware
Weakness classification (CWE)
References
- www.westerndigital.com/support/product-security/wdc-22005-netatalk-security-vul… (Vendor Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory, Mailing List)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory, Mailing List)
- security.gentoo.org/glsa/202311-02 (vendor-advisory, Third Party Advisory, Issue Tracking)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory, Mailing List)
- lists.debian.org/debian-lts-announce/2024/01/msg00000.html (mailing-list)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2022-22995?
- CVE-2022-22995 is a critical-severity vulnerability in Netatalk, classified under Improper Link Resolution Before File Access. CVSS score: 10.0/10. Published 2022-03-25.
- How severe is CVE-2022-22995?
- Critical severity. CVSS v3 base score is 10.0 out of 10.