CVE-2022-22988— Insecure file and directory permissions on EdgeRover
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-22988
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Insecure file and directory permissions on EdgeRover
Source: NVD (National Vulnerability Database)
Vulnerability Description
File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources. It would be more difficult for an authenticated attacker to now traverse through the files and directories. This can only be exploited once an attacker has already found a way to get authenticated access to the device.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
Permission Issues
Source: NVD (National Vulnerability Database)
Vulnerability Title
Western Digital EdgeRover 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Western Digital EdgeRover是美国西部数据（Western Digital）公司的一款个人内容应用程序。 Western Digital EdgeRover存在安全漏洞，攻击者可利用该漏洞修改或访问机密资源。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Western Digital | EdgeRover | EdgeRover Mac Desktop App ~ 1.5.0-576 | - | |
| Western Digital | EdgeRover | EdgeRover Windows Desktop App ~ 1.5.0-576 | - |
II. Public POCs for CVE-2022-22988
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-22988
请登录查看更多情报信息。
Same Patch Batch · Western Digital · 2022-01-13 · 4 CVEs total
| CVE-2022-22989 | 9.8 CRITICAL | Pre-authenticated stack overflow vulnerability on FTP Service |
| CVE-2022-22990 | 7.8 HIGH | Limited authentication bypass vulnerability on Western Digital My Cloud devices |
| CVE-2022-22991 | 7.8 HIGH | Command injection through unsecured HTTP calls on Western Digital My Cloud devices |
IV. Related Vulnerabilities
Same vendor: Western Digital
V. Comments for CVE-2022-22988
No comments yet