Unrestricted file upload

2019-04-2418:29:00

PRIOn knowledge base

www.prio-n.com

9.5 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.9%

JSON

Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an unauthenticated file upload vulnerability. The page web/jquery/uploader/uploadify.php can be accessed without any credentials, and allows uploading arbitrary files to any location on the attached storage.

CPENameOperatorVersion
my_cloud_dl2100lt2.31.174
my_cloud_dl4100_firmwarelt2.31.174
my_cloud_ex2100_firmwarelt2.31.174
my_cloud_ex2_ultra_firmwarelt2.31.174
my_cloud_ex4100lt2.31.174
my_cloud_firmwarelt2.31.174
my_cloud_mirror_gen_2_firmwarelt2.31.174
my_cloud_pr2100_firmwarelt2.31.174
my_cloud_pr4100lt2.31.174

Name	Operator	Version
my_cloud_dl2100	lt	2.31.174
my_cloud_dl4100_firmware	lt	2.31.174
my_cloud_ex2100_firmware	lt	2.31.174
my_cloud_ex2_ultra_firmware	lt	2.31.174
my_cloud_ex4100	lt	2.31.174
my_cloud_firmware	lt	2.31.174
my_cloud_mirror_gen_2_firmware	lt	2.31.174
my_cloud_pr2100_firmware	lt	2.31.174
my_cloud_pr4100	lt	2.31.174