Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to write files to locations with certain critical filesystem types leading to remote code execution was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This issue requires an authentication bypass issue to be triggered before this can be exploited.
This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191; My Cloud OS 5: before 5.26.202.
References
| Link | Resource |
|---|---|
| https://www.westerndigital.com/support/product-security/wdc-23003-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-9-4-0-191 | Release Notes Vendor Advisory |
| https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmware-version-5-26-202 | Release Notes Vendor Advisory |
| https://www.westerndigital.com/support/product-security/wdc-23003-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-9-4-0-191 | Release Notes Vendor Advisory |
| https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmware-version-5-26-202 | Release Notes Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
History
21 Nov 2024, 07:12
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.8 |
| References | () https://www.westerndigital.com/support/product-security/wdc-23003-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-9-4-0-191 - Release Notes, Vendor Advisory | |
| References | () https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmware-version-5-26-202 - Release Notes, Vendor Advisory |
31 May 2023, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to write files to locations with certain critical filesystem types leading to remote code execution was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This issue requires an authentication bypass issue to be triggered before this can be exploited. This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191; My Cloud OS 5: before 5.26.202. |
30 May 2023, 14:04
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:westerndigital:sandisk_ibi_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:westerndigital:my_cloud_ex2_ultra:-:*:*:*:*:*:*:* cpe:2.3:h:westerndigital:my_cloud_home_duo:-:*:*:*:*:*:*:* cpe:2.3:h:westerndigital:sandisk_ibi:-:*:*:*:*:*:*:* cpe:2.3:h:westerndigital:my_cloud_dl2100:-:*:*:*:*:*:*:* cpe:2.3:h:westerndigital:wd_cloud:-:*:*:*:*:*:*:* cpe:2.3:h:westerndigital:my_cloud_dl4100:-:*:*:*:*:*:*:* cpe:2.3:h:westerndigital:my_cloud_ex2100:-:*:*:*:*:*:*:* cpe:2.3:h:westerndigital:my_cloud_home:-:*:*:*:*:*:*:* cpe:2.3:h:westerndigital:my_cloud_pr4100:-:*:*:*:*:*:*:* cpe:2.3:h:westerndigital:my_cloud_pr2100:-:*:*:*:*:*:*:* cpe:2.3:o:westerndigital:my_cloud_home_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:westerndigital:my_cloud_mirror_g2:-:*:*:*:*:*:*:* cpe:2.3:h:westerndigital:my_cloud_ex4100:-:*:*:*:*:*:*:* cpe:2.3:h:westerndigital:my_cloud:-:*:*:*:*:*:*:* cpe:2.3:o:westerndigital:my_cloud_home_duo_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:westerndigital:my_cloud_os_5:*:*:*:*:*:*:*:* |
|
| References | (MISC) https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmware-version-5-26-202 - Release Notes, Vendor Advisory | |
| References | (MISC) https://www.westerndigital.com/support/product-security/wdc-23003-western-digital-my-cloud-home-my-cloud-home-duo-and-sandisk-ibi-firmware-version-9-4-0-191 - Release Notes, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CWE | CWE-22 |
18 May 2023, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-05-18 18:15
Updated : 2024-11-21 07:12
NVD link : CVE-2022-36327
Mitre link : CVE-2022-36327
CVE.ORG link : CVE-2022-36327
JSON object : View
Products Affected
westerndigital
- my_cloud_ex2_ultra
- wd_cloud
- my_cloud_ex2100
- my_cloud_ex4100
- my_cloud_os_5
- my_cloud_pr4100
- sandisk_ibi
- my_cloud_home_firmware
- sandisk_ibi_firmware
- my_cloud_home_duo_firmware
- my_cloud_mirror_g2
- my_cloud_home_duo
- my_cloud_dl2100
- my_cloud_dl4100
- my_cloud_home
- my_cloud_pr2100
- my_cloud
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')