CVE-2022-22995

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-22995
The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.

10.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://lists.debian.org/debian-lts-announce/2024/01/msg00000.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/55ROUJI22SHZX5EM23QAILZHI67EZQKW/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5CZZLFOTUP3QYHGHSDUNENGSLPJ6KGO/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO34FWOIJI6V6PH2XY52WNBBARVWPJG2/ Mailing List
https://security.gentoo.org/glsa/202311-02 Issue Tracking Third Party Advisory
https://www.westerndigital.com/support/product-security/wdc-22005-netatalk-security-vulnerabilities Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/01/msg00000.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/55ROUJI22SHZX5EM23QAILZHI67EZQKW/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5CZZLFOTUP3QYHGHSDUNENGSLPJ6KGO/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO34FWOIJI6V6PH2XY52WNBBARVWPJG2/ Mailing List
https://security.gentoo.org/glsa/202311-02 Issue Tracking Third Party Advisory
https://www.westerndigital.com/support/product-security/wdc-22005-netatalk-security-vulnerabilities Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:westerndigital:my_cloud_pr2100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_pr2100:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:westerndigital:my_cloud_pr4100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_pr4100:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:westerndigital:my_cloud_ex4100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_ex4100:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:westerndigital:my_cloud_ex2_ultra_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_ex2_ultra:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:westerndigital:my_cloud_mirror_gen_2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_mirror_gen_2:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:westerndigital:my_cloud_dl2100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_dl2100:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:westerndigital:my_cloud_dl4100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_dl4100:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:westerndigital:my_cloud_ex2100_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_ex2100:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:westerndigital:my_cloud_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:westerndigital:wd_cloud_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:wd_cloud:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:westerndigital:my_cloud_home_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:westerndigital:my_cloud_home:-:*:*:*:*:*:*:*

Configuration 12 (hide)

OR cpe:2.3:a:netatalk:netatalk:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
History

21 Nov 2024, 06:47

Type Values Removed Values Added
References () https://lists.debian.org/debian-lts-announce/2024/01/msg00000.html - () https://lists.debian.org/debian-lts-announce/2024/01/msg00000.html -
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/55ROUJI22SHZX5EM23QAILZHI67EZQKW/ - Mailing List () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/55ROUJI22SHZX5EM23QAILZHI67EZQKW/ - Mailing List
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5CZZLFOTUP3QYHGHSDUNENGSLPJ6KGO/ - Mailing List () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5CZZLFOTUP3QYHGHSDUNENGSLPJ6KGO/ - Mailing List
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO34FWOIJI6V6PH2XY52WNBBARVWPJG2/ - Mailing List () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO34FWOIJI6V6PH2XY52WNBBARVWPJG2/ - Mailing List
References () https://security.gentoo.org/glsa/202311-02 - Issue Tracking, Third Party Advisory () https://security.gentoo.org/glsa/202311-02 - Issue Tracking, Third Party Advisory
References () https://www.westerndigital.com/support/product-security/wdc-22005-netatalk-security-vulnerabilities - Vendor Advisory () https://www.westerndigital.com/support/product-security/wdc-22005-netatalk-security-vulnerabilities - Vendor Advisory
CVSS v2 : 7.5
v3 : 9.8 		v2 : 7.5
v3 : 10.0

04 Jan 2024, 22:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/01/msg00000.html -

28 Dec 2023, 15:19

Type Values Removed Values Added
CPE cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:a:netatalk:netatalk:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
First Time Fedoraproject fedora
Netatalk
Fedoraproject
Netatalk netatalk
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/55ROUJI22SHZX5EM23QAILZHI67EZQKW/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/55ROUJI22SHZX5EM23QAILZHI67EZQKW/ - Mailing List
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5CZZLFOTUP3QYHGHSDUNENGSLPJ6KGO/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5CZZLFOTUP3QYHGHSDUNENGSLPJ6KGO/ - Mailing List
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO34FWOIJI6V6PH2XY52WNBBARVWPJG2/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO34FWOIJI6V6PH2XY52WNBBARVWPJG2/ - Mailing List
References (GENTOO) https://security.gentoo.org/glsa/202311-02 - (GENTOO) https://security.gentoo.org/glsa/202311-02 - Issue Tracking, Third Party Advisory

07 Nov 2023, 03:44

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55ROUJI22SHZX5EM23QAILZHI67EZQKW/', 'name': 'FEDORA-2023-39f0ec3879', 'tags': [], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T5CZZLFOTUP3QYHGHSDUNENGSLPJ6KGO/', 'name': 'FEDORA-2023-ef901c862c', 'tags': [], 'refsource': 'FEDORA'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XO34FWOIJI6V6PH2XY52WNBBARVWPJG2/', 'name': 'FEDORA-2023-cec97f7b5d', 'tags': [], 'refsource': 'FEDORA'}
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/55ROUJI22SHZX5EM23QAILZHI67EZQKW/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T5CZZLFOTUP3QYHGHSDUNENGSLPJ6KGO/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO34FWOIJI6V6PH2XY52WNBBARVWPJG2/ -

03 Nov 2023, 21:15

Type Values Removed Values Added
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/55ROUJI22SHZX5EM23QAILZHI67EZQKW/ -

01 Nov 2023, 17:15

Type Values Removed Values Added
References
  • (GENTOO) https://security.gentoo.org/glsa/202311-02 -

14 Oct 2023, 03:15

Type Values Removed Values Added
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T5CZZLFOTUP3QYHGHSDUNENGSLPJ6KGO/ -
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XO34FWOIJI6V6PH2XY52WNBBARVWPJG2/ -
Information

Published : 2022-03-25 23:15

Updated : 2024-11-21 06:47

NVD link : CVE-2022-22995

Mitre link : CVE-2022-22995

CVE.ORG link : CVE-2022-22995

JSON object : View

Products Affected

westerndigital

  • my_cloud_pr2100
  • my_cloud_dl4100
  • my_cloud_dl4100_firmware
  • my_cloud_ex4100_firmware
  • wd_cloud_firmware
  • my_cloud_firmware
  • wd_cloud
  • my_cloud_pr4100
  • my_cloud_home
  • my_cloud_mirror_gen_2
  • my_cloud_mirror_gen_2_firmware
  • my_cloud_ex2_ultra_firmware
  • my_cloud_home_firmware
  • my_cloud_ex2100_firmware
  • my_cloud_ex4100
  • my_cloud_dl2100_firmware
  • my_cloud_ex2100
  • my_cloud_pr4100_firmware
  • my_cloud_pr2100_firmware
  • my_cloud_ex2_ultra
  • my_cloud_dl2100
  • my_cloud

fedoraproject

  • fedora

netatalk

  • netatalk
CWE
CWE-59

Improper Link Resolution Before File Access ('Link Following')