CVE-2020-27160 — Path Traversal in MY Cloud Firmware

CWE-22 — Path TraversalCWE-269 — Improper Privilege Management2 documents2 sources
Severity
9.8CRITICALNVD
EPSS
4.9%
top 10.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Westerndigital MY Cloud Firmware
Timeline
PublishedOct 27
Latest updateMay 24

Description

Addressed remote code execution vulnerability in AvailableApps.php that allowed escalation of privileges in Western Digital My Cloud NAS devices prior to 5.04.114 (issue 3 of 3).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

1
GHSA
GHSA-gf5r-4gp7-7h4h: Addressed remote code execution vulnerability in AvailableApps↗2022-05-24
▶
CVE-2020-27160 — Path Traversal in MY Cloud Firmware | cvebase