Sign-up

ID

VAR-202103-1086


CVE

CVE-2021-3310


TITLE

Western Digital My Cloud OS 5  Link interpretation vulnerability in device

Trust: 0.8

sources: JVNDB: JVNDB-2021-004443

DESCRIPTION

Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares. This can lead to code execution and information disclosure (by reading local files). This vulnerability allows remote attackers to disclose sensitive information on affected installations of Western Digital MyCloud PR4100. Authentication is not required to exploit this vulnerability.The specific flaw exists within the SMB and AFP services. By creating a symbolic link, an attacker can abuse the service to read arbitrary files. An attacker can leverage this vulnerability to disclose information in the context of the service account. Western Digital My Cloud is a personal cloud storage device of Western Digital Corporation

Trust: 2.88

sources: NVD: CVE-2021-3310 // JVNDB: JVNDB-2021-004443 // ZDI: ZDI-21-277 // CNVD: CNVD-2022-06495 // VULMON: CVE-2021-3310

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-06495

AFFECTED PRODUCTS

vendor:westerndigitalmodel:my cloud osscope:ltversion:5.10.122

Trust: 1.0

vendor:western digitalmodel:my cloud os 5scope:eqversion:my cloud os 5 firmware 5.10.122

Trust: 0.8

vendor:western digitalmodel:my cloud os 5scope:eqversion: -

Trust: 0.8

vendor:western digitalmodel:mycloud pr4100scope: - version: -

Trust: 0.7

vendor:westernmodel:digital my cloud osscope:eqversion:5<5.10.122

Trust: 0.6

sources: ZDI: ZDI-21-277 // CNVD: CNVD-2022-06495 // JVNDB: JVNDB-2021-004443 // NVD: CVE-2021-3310

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-3310
value: HIGH

Trust: 1.0

NVD: CVE-2021-3310
value: HIGH

Trust: 0.8

ZDI: CVE-2021-3310
value: HIGH

Trust: 0.7

CNVD: CNVD-2022-06495
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202103-759
value: HIGH

Trust: 0.6

VULMON: CVE-2021-3310
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-3310
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2022-06495
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2021-3310
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2021-3310
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2021-3310
baseSeverity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-21-277 // CNVD: CNVD-2022-06495 // VULMON: CVE-2021-3310 // JVNDB: JVNDB-2021-004443 // CNNVD: CNNVD-202103-759 // NVD: CVE-2021-3310

PROBLEMTYPE DATA

problemtype:CWE-59

Trust: 1.0

problemtype:Link interpretation problem (CWE-59) [NVD Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-004443 // NVD: CVE-2021-3310

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202103-759

TYPE

post link

Trust: 0.6

sources: CNNVD: CNNVD-202103-759

PATCH

title:WDC-21002url:https://www.westerndigital.com/support/product-security/wdc-21002-my-cloud-firmware-version-5-10-122

Trust: 0.8

title:Western Digital has issued an update to correct this vulnerability.url:https://www.westerndigital.com/support/productsecurity/wdc-21002-my-cloud-firmware-version-5-10-122

Trust: 0.7

title:Patch for Western Digital My Cloud OS 5 Backlink Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/315876

Trust: 0.6

title:Western Digital My Cloud Post-link vulnerability fixesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=144474

Trust: 0.6

title:PoCurl:https://github.com/Jonathan-Elias/PoC

Trust: 0.1

sources: ZDI: ZDI-21-277 // CNVD: CNVD-2022-06495 // VULMON: CVE-2021-3310 // JVNDB: JVNDB-2021-004443 // CNNVD: CNNVD-202103-759

EXTERNAL IDS

db:NVDid:CVE-2021-3310

Trust: 3.8

db:ZDIid:ZDI-21-277

Trust: 3.2

db:JVNDBid:JVNDB-2021-004443

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-12455

Trust: 0.7

db:CNVDid:CNVD-2022-06495

Trust: 0.6

db:CNNVDid:CNNVD-202103-759

Trust: 0.6

db:VULMONid:CVE-2021-3310

Trust: 0.1

sources: ZDI: ZDI-21-277 // CNVD: CNVD-2022-06495 // VULMON: CVE-2021-3310 // JVNDB: JVNDB-2021-004443 // CNNVD: CNNVD-202103-759 // NVD: CVE-2021-3310

REFERENCES

url:https://www.zerodayinitiative.com/advisories/zdi-21-277/

Trust: 2.6

url:https://www.westerndigital.com/support/productsecurity/wdc-21002-my-cloud-firmware-version-5-10-122

Trust: 2.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-3310

Trust: 2.0

url:https://cwe.mitre.org/data/definitions/59.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: ZDI: ZDI-21-277 // CNVD: CNVD-2022-06495 // VULMON: CVE-2021-3310 // JVNDB: JVNDB-2021-004443 // CNNVD: CNNVD-202103-759 // NVD: CVE-2021-3310

CREDITS

Chris Hernandez

Trust: 0.7

sources: ZDI: ZDI-21-277

SOURCES

db:ZDIid:ZDI-21-277
db:CNVDid:CNVD-2022-06495
db:VULMONid:CVE-2021-3310
db:JVNDBid:JVNDB-2021-004443
db:CNNVDid:CNNVD-202103-759
db:NVDid:CVE-2021-3310

LAST UPDATE DATE

2024-11-23T22:11:05.379000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-21-277date:2021-06-29T00:00:00
db:CNVDid:CNVD-2022-06495date:2022-01-25T00:00:00
db:VULMONid:CVE-2021-3310date:2021-03-17T00:00:00
db:JVNDBid:JVNDB-2021-004443date:2021-11-22T08:38:00
db:CNNVDid:CNNVD-202103-759date:2021-03-19T00:00:00
db:NVDid:CVE-2021-3310date:2024-11-21T06:21:15.400

SOURCES RELEASE DATE

db:ZDIid:ZDI-21-277date:2021-03-11T00:00:00
db:CNVDid:CNVD-2022-06495date:2022-01-25T00:00:00
db:VULMONid:CVE-2021-3310date:2021-03-10T00:00:00
db:JVNDBid:JVNDB-2021-004443date:2021-11-22T00:00:00
db:CNNVDid:CNNVD-202103-759date:2021-03-10T00:00:00
db:NVDid:CVE-2021-3310date:2021-03-10T05:15:13.517