nvd-json-data-feeds/CVE-2022/CVE-2022-363xx/CVE-2022-36327.json

{
  "id": "CVE-2022-36327",
  "sourceIdentifier": "psirt@wdc.com",
  "published": "2023-05-18T18:15:09.883",
  "lastModified": "2023-05-31T19:15:23.253",
  "vulnStatus": "Modified",
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to write files to locations with certain critical filesystem types leading to remote code execution was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This issue requires an authentication bypass issue to be triggered before this can be exploited.\u00a0\nThis issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191; My Cloud OS 5: before 5.26.202."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      },
      {
        "source": "psirt@wdc.com",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE",
          "baseScore": 5.8,
          "baseSeverity": "MEDIUM"
        },
        "exploitabilityScore": 1.3,
        "impactScore": 4.0
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    },
    {
      "source": "psirt@wdc.com",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:westerndigital:my_cloud_os_5:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "5.26.202",
              "matchCriteriaId": "056AA1A3-F012-40A9-A351-628C905B3FEA"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:westerndigital:my_cloud:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3A9EE86B-05EE-4F2E-A912-624DDCF9C41B"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:westerndigital:my_cloud_dl2100:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9E783EBC-7608-4527-B1AD-9B4E7A7A108C"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:westerndigital:my_cloud_dl4100:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F3034F4A-239C-4E38-9BD6-217361A7C519"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:westerndigital:my_cloud_ex2_ultra:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5A581EBA-A1F2-4ABC-8183-29973A46FA43"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:westerndigital:my_cloud_ex2100:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "ABBBDC1E-2320-4767-B669-1BB2FFB1E1C4"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:westerndigital:my_cloud_ex4100:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B78030F0-6655-4604-9D16-2FA1F3FD52FF"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:westerndigital:my_cloud_mirror_g2:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6DE090BC-C847-4DF7-9C5F-52A300845558"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:westerndigital:my_cloud_pr2100:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF58260B-2131-402C-A9DA-67B188136DE1"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:westerndigital:my_cloud_pr4100:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CB0C2FD9-4792-4DA2-9698-E53109A499EC"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:westerndigital:wd_cloud:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8FDE0337-4329-4CE3-9B0B-61BE8361E910"
            }
          ]
        }
      ]
    },
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:westerndigital:my_cloud_home_firmware:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "9.4.0-191",
              "matchCriteriaId": "D471C39A-0854-4755-9DF8-5BAABAB09619"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:westerndigital:my_cloud_home:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2BE2FBAB-5BA0-4F09-A76E-4A6869668810"
            }
          ]
        }
      ]
    },
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:westerndigital:sandisk_ibi_firmware:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "9.4.0-191",
              "matchCriteriaId": "13A2FB91-CCCF-42B1-BCE1-F4962D353593"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:westerndigital:sandisk_ibi:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "296ADA43-16BA-4444-B472-DB945FB917B2"
            }
          ]
        }
      ]
    },
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:westerndigital:my_cloud_home_duo_firmware:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "9.4.0-191",
              "matchCriteriaId": "0A0368E6-53C8-4BD2-B0E8-44464B245832"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:westerndigital:my_cloud_home_duo:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "124BBC79-65A2-465C-B784-D21E57E96F63"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.westerndigital.com/support/product-security/wdc-23003-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-9-4-0-191",
      "source": "psirt@wdc.com",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmware-version-5-26-202",
      "source": "psirt@wdc.com",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ]
    }
  ]
}