CVE-2023-22813

published 2023-05-08

CVE-2023-22813: A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile Apps…

Priority P4 20 medium 4.3 CVSS 3.1

AV N AC L PR N UI R S U C L I N A N

A device API
endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile Apps, SanDisk ibi iOS and Android Mobile Apps, My Cloud OS 5 Web App, My Cloud Home Web App and the SanDisk ibi Web App. Due to a permissive CORS policy
and missing authentication requirement for private IPs, a remote attacker on
the same network as the device could obtain device information by convincing a
victim user to visit an attacker-controlled server and issue a cross-site
request.

This issue affects
My Cloud OS 5 Mobile App: before 4.21.0; My Cloud Home Mobile App: before 4.21.0; ibi Mobile App: before 4.21.0; My
Cloud OS 5 Web App: before 4.26.0-6126; My Cloud Home Web App: before 4.26.0-6126;
ibi Web App: before 4.26.0-6126.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
sandisk	ibi_mobile_app	< 4.21.0	4.21.0
sandisk	ibi_web_app	< 4.26.0-6126	4.26.0-6126
western_digital	my_cloud_home_mobile_app	< 4.21.0	4.21.0
western_digital	my_cloud_home_web_app	< 4.26.0-6126	4.26.0-6126
western_digital	my_cloud_os_5_mobile_app	< 4.21.0	4.21.0
western_digital	my_cloud_os_5_web_app	< 4.26.0-6126	4.26.0-6126
westerndigital	my_cloud	< 4.26.0-6126	4.26.0-6126
westerndigital	my_cloud_home	< 4.21.0	4.21.0
westerndigital	my_cloud_home	< 4.26.0-6126	4.26.0-6126
westerndigital	my_cloud_os_5	< 4.21.0	4.21.0
westerndigital	sandisk_ibi	< 4.21.0	4.21.0
westerndigital	sandisk_ibi	< 4.26.0-6126	4.26.0-6126

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200 CWE-862