XSS in Western Digital My Cloud
CVE-2022-22999
Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user with elevated privileges access to drives being backed up to construct and inject JavaScript payloads into an authenticated user's browser. As a result, it may be possible to gain control over the authenticated session, steal data, modify settings, or redirect the user to malicious websites. The scope of impact can extend to other components.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.004 (28.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Western Digital My Cloud — versions My Cloud OS 5
- Westerndigital My_cloud_dl2100
- Westerndigital My_cloud_dl2100_firmware
- Westerndigital My_cloud_dl4100
- Westerndigital My_cloud_dl4100_firmware
- Westerndigital My_cloud_ex2100
- Westerndigital My_cloud_ex2100_firmware
- Westerndigital My_cloud_ex2_ultra
- Westerndigital My_cloud_ex2_ultra_firmware
- Westerndigital My_cloud_ex4100
Weakness classification (CWE)
References
- psirt@wdc.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-22999?
- CVE-2022-22999 is a high-severity vulnerability in Western Digital My Cloud, classified under Cross-site Scripting. CVSS score: 8.2/10. Published 2022-07-25.
- How severe is CVE-2022-22999?
- High severity. CVSS v3 base score is 8.2 out of 10.