Vulnerability in Netatalk
CVE-2022-22995
The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.
EPSS: 0.027 (83.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L.
Affected products
- Netatalk
- Western Digital My Cloud — versions My Cloud OS 5
- Western Digital My Cloud Home — versions My Cloud Home
- Westerndigital My_cloud
- Westerndigital My_cloud_dl2100
- Westerndigital My_cloud_dl2100_firmware
- Westerndigital My_cloud_dl4100
- Westerndigital My_cloud_dl4100_firmware
- Westerndigital My_cloud_ex2100
- Westerndigital My_cloud_ex2100_firmware
Weakness classification (CWE)
References
- psirt@wdc.com (Vendor Advisory)
- psirt@wdc.com (vendor-advisory, Mailing List)
- psirt@wdc.com (vendor-advisory, Mailing List)
- psirt@wdc.com (vendor-advisory, Third Party Advisory, Issue Tracking)
- psirt@wdc.com (vendor-advisory, Mailing List)
- psirt@wdc.com (mailing-list)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2022-22995?
- CVE-2022-22995 is a critical-severity vulnerability in Netatalk, classified under Improper Link Resolution Before File Access. CVSS score: 10.0/10. Published 2022-03-25.
- How severe is CVE-2022-22995?
- Critical severity. CVSS v3 base score is 10.0 out of 10.