Vulnerability Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to create arbitrary shares on arbitrary directories and exfiltrate sensitive files, passwords, users and device configurations was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This can only be exploited once an attacker gains root privileges on the devices using an authentication bypass issue or another vulnerability.This issue affects My Cloud Home and My Cloud Home Duo: before 9.4.0-191; ibi: before 9.4.0-191; My Cloud OS 5: before 5.26.202.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Westerndigital | My Cloud Os 5 | < 5.26.202 |
| Westerndigital | My Cloud | - |
| Westerndigital | My Cloud Dl2100 | - |
| Westerndigital | My Cloud Dl4100 | - |
| Westerndigital | My Cloud Ex2 Ultra | - |
| Westerndigital | My Cloud Ex2100 | - |
| Westerndigital | My Cloud Ex4100 | - |
| Westerndigital | My Cloud Mirror G2 | - |
| Westerndigital | My Cloud Pr2100 | - |
| Westerndigital | My Cloud Pr4100 | - |
| Westerndigital | Wd Cloud | - |
| Westerndigital | My Cloud Home Firmware | < 9.4.0-191 |
| Westerndigital | My Cloud Home | - |
| Westerndigital | Sandisk Ibi Firmware | < 9.4.0-191 |
| Westerndigital | Sandisk Ibi | - |
| Westerndigital | My Cloud Home Duo Firmware | < 9.4.0-191 |
| Westerndigital | My Cloud Home Duo | - |
Related Weaknesses (CWE)
References
- https://www.westerndigital.com/support/product-security/wdc-23003-western-digitaRelease NotesVendor Advisory
- https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmwRelease NotesVendor Advisory
- https://www.westerndigital.com/support/product-security/wdc-23003-western-digitaRelease NotesVendor Advisory
- https://www.westerndigital.com/support/product-security/wdc-23006-my-cloud-firmwRelease NotesVendor Advisory
FAQ
What is CVE-2022-36328?
CVE-2022-36328 is a vulnerability with a CVSS score of 5.8 (MEDIUM). Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to create arbitrary shares on arbitrary directories and exfiltrate sensitive f...
How severe is CVE-2022-36328?
CVE-2022-36328 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-36328?
Check the references section above for vendor advisories and patch information. Affected products include: Westerndigital My Cloud Os 5, Westerndigital My Cloud, Westerndigital My Cloud Dl2100, Westerndigital My Cloud Dl4100, Westerndigital My Cloud Ex2 Ultra.