Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user with elevated privileges access to drives being backed up to construct and inject JavaScript payloads into an authenticated user's browser. As a result, it may be possible to gain control over the authenticated session, steal data, modify settings, or redirect the user to malicious websites. The scope of impact can extend to other components.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
westerndigital my_cloud_pr2100_firmware |
||
westerndigital my_cloud_pr4100_firmware |
||
westerndigital my_cloud_ex4100_firmware |
||
westerndigital my_cloud_ex2_ultra_firmware |
||
westerndigital my_cloud_mirror_g2_firmware |
||
westerndigital my_cloud_dl2100_firmware |
||
westerndigital my_cloud_dl4100_firmware |
||
westerndigital my_cloud_ex2100_firmware |
Vulmon