Sign-up

ID

VAR-202012-0950


CVE

CVE-2020-29563


TITLE

Western Digital My Cloud OS 5  Authentication vulnerability in device

Trust: 0.8

sources: JVNDB: JVNDB-2020-014425

DESCRIPTION

An issue was discovered on Western Digital My Cloud OS 5 devices before 5.07.118. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to gain access to the device. This vulnerability allows remote attackers to bypass authentication on affected installations of Western Digital MyCloud PR4100. Authentication is not required to exploit this vulnerability.The specific flaw exists within the mod_rewrite module. The issue results from the way the software parses URLs to make authorization decisions. An attacker can leverage this vulnerability to bypass authentication on the system

Trust: 2.79

sources: NVD: CVE-2020-29563 // JVNDB: JVNDB-2020-014425 // ZDI: ZDI-20-1446 // CNVD: CNVD-2022-06496

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-06496

AFFECTED PRODUCTS

vendor:westerndigitalmodel:my cloud os 5scope:ltversion:5.07.118

Trust: 1.0

vendor:western digitalmodel:my cloud os 5scope:eqversion: -

Trust: 0.8

vendor:western digitalmodel:my cloud os 5scope:eqversion:my cloud os 5 firmware 5.07.118

Trust: 0.8

vendor:western digitalmodel:mycloud pr4100scope: - version: -

Trust: 0.7

vendor:westernmodel:digital my cloud osscope:eqversion:5<5.07.118

Trust: 0.6

sources: ZDI: ZDI-20-1446 // CNVD: CNVD-2022-06496 // JVNDB: JVNDB-2020-014425 // NVD: CVE-2020-29563

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-29563
value: CRITICAL

Trust: 1.0

NVD: CVE-2020-29563
value: CRITICAL

Trust: 0.8

ZDI: CVE-2020-29563
value: CRITICAL

Trust: 0.7

CNVD: CNVD-2022-06496
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202012-942
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2020-29563
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2022-06496
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2020-29563
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2020-29563
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2020-29563
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-20-1446 // CNVD: CNVD-2022-06496 // JVNDB: JVNDB-2020-014425 // CNNVD: CNNVD-202012-942 // NVD: CVE-2020-29563

PROBLEMTYPE DATA

problemtype:CWE-287

Trust: 1.0

problemtype:Improper authentication (CWE-287) [NVD Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2020-014425 // NVD: CVE-2020-29563

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202012-942

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-202012-942

PATCH

title:WDC-20010url:https://www.westerndigital.com/support/productsecurity/wdc-20010-my-cloud-os5-firmware-5-07-118

Trust: 1.5

title:Patch for Western Digital My Cloud OS 5 Authorization Issue Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/315866

Trust: 0.6

title:Western Digital My Cloud Remediation measures for authorization problem vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=137294

Trust: 0.6

sources: ZDI: ZDI-20-1446 // CNVD: CNVD-2022-06496 // JVNDB: JVNDB-2020-014425 // CNNVD: CNNVD-202012-942

EXTERNAL IDS

db:NVDid:CVE-2020-29563

Trust: 3.7

db:ZDIid:ZDI-20-1446

Trust: 3.1

db:JVNDBid:JVNDB-2020-014425

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-12465

Trust: 0.7

db:CNVDid:CNVD-2022-06496

Trust: 0.6

db:CNNVDid:CNNVD-202012-942

Trust: 0.6

sources: ZDI: ZDI-20-1446 // CNVD: CNVD-2022-06496 // JVNDB: JVNDB-2020-014425 // CNNVD: CNNVD-202012-942 // NVD: CVE-2020-29563

REFERENCES

url:https://www.zerodayinitiative.com/advisories/zdi-20-1446/

Trust: 2.4

url:https://www.westerndigital.com/support/productsecurity/wdc-20010-my-cloud-os5-firmware-5-07-118

Trust: 2.3

url:https://nvd.nist.gov/vuln/detail/cve-2020-29563

Trust: 2.0

sources: ZDI: ZDI-20-1446 // CNVD: CNVD-2022-06496 // JVNDB: JVNDB-2020-014425 // CNNVD: CNNVD-202012-942 // NVD: CVE-2020-29563

CREDITS

orangetw

Trust: 0.7

sources: ZDI: ZDI-20-1446

SOURCES

db:ZDIid:ZDI-20-1446
db:CNVDid:CNVD-2022-06496
db:JVNDBid:JVNDB-2020-014425
db:CNNVDid:CNNVD-202012-942
db:NVDid:CVE-2020-29563

LAST UPDATE DATE

2024-11-23T23:07:45.802000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-20-1446date:2020-12-15T00:00:00
db:CNVDid:CNVD-2022-06496date:2022-01-25T00:00:00
db:JVNDBid:JVNDB-2020-014425date:2021-08-18T08:49:00
db:CNNVDid:CNNVD-202012-942date:2022-08-10T00:00:00
db:NVDid:CVE-2020-29563date:2024-11-21T05:24:12.447

SOURCES RELEASE DATE

db:ZDIid:ZDI-20-1446date:2020-12-15T00:00:00
db:CNVDid:CNVD-2022-06496date:2022-01-25T00:00:00
db:JVNDBid:JVNDB-2020-014425date:2021-08-18T00:00:00
db:CNNVDid:CNNVD-202012-942date:2020-12-11T00:00:00
db:NVDid:CVE-2020-29563date:2020-12-12T00:15:12.017