CVEvulnerability

CVE-2019-9951

9.8 CRITICAL Published 2019-04-24 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-04-24
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-434

Description

Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an unauthenticated file upload vulnerability. The page web/jquery/uploader/uploadify.php can be accessed without any credentials, and allows uploading arbitrary files to any location on the attached storage.

Affected configurations

• western digital my cloud mirror gen 2 firmware (< 2.31.174) • western digital my cloud ex2 ultra firmware (< 2.31.174) • western digital my cloud ex2100 firmware (< 2.31.174) • western digital my cloud ex4100 (< 2.31.174) • western digital my cloud dl2100 (< 2.31.174) • western digital my cloud dl4100 firmware (< 2.31.174) • western digital my cloud pr2100 firmware (< 2.31.174) • western digital my cloud pr4100 (< 2.31.174) • western digital my cloud firmware (< 2.31.174)

Related

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References