CVE-2022-29840 MEDIUM

CVE-2022-29840: Server Side Request Forgery Vulnerability in Western Digital My Cloud Devices

Vendor Western Digital
Product My Cloud OS 5
Weakness CWE-918 · SSRF
Published May 10, 2023
Last update January 24, 2025
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Local
Attack complexity High
Privileges required None
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

Server-Side Request Forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL to point back to the loopback adapter was addressed in Western Digital My Cloud OS 5 devices. This could allow the URL to exploit other vulnerabilities on the local server.This issue affects My Cloud OS 5 devices before 5.26.202.

Key dates

02Disclosure timeline

May 10, 2023 CVE published
January 24, 2025 Record updated