CVE-2022-22988

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources. It would be more difficult for an authenticated attacker to now traverse through the files and directories. This can only be exploited once an attacker has already found a way to get authenticated access to the device.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-275 CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Jan 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-229899.8My Cloud OS 5 was vulnerable to a pre-authenticated stack overflow vulnerability on the FTP service that could be exploited by unauthenticat CVE-2022-22995.4The Allow SVG Files WordPress plugin through 1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author CVE-2022-229908.8A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate priv CVE-2022-229918.8A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an CVE-2022-229929.8A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to e CVE-2022-229938.8A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and rea CVE-2022-229949.8A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loa CVE-2022-229959.8The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting the CVE-2022-229967.8The G-RAID 4/8 Software Utility setups for Windows were affected by a DLL hijacking vulnerability. Successful exploitation could lead to arb CVE-2022-229979.8Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially CVE-2022-229987.5Implemented protections on AWS credentials that were not properly protected.CVE-2022-229994.8Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user with elevated privil