FKIE_CVE-2023-22813

Vulnerability from fkie_nvd - Published: 2023-05-08 23:15 - Updated: 2026-06-17 05:36
Severity
3.3 (Low) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Summary
A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile Apps, SanDisk ibi iOS and Android Mobile Apps, My Cloud OS 5 Web App, My Cloud Home Web App and the SanDisk ibi Web App. Due to a permissive CORS policy and missing authentication requirement for private IPs, a remote attacker on the same network as the device could obtain device information by convincing a victim user to visit an attacker-controlled server and issue a cross-site request. This issue affects My Cloud OS 5 Mobile App: before 4.21.0; My Cloud Home Mobile App: before 4.21.0; ibi Mobile App: before 4.21.0; My Cloud OS 5 Web App: before 4.26.0-6126; My Cloud Home Web App: before 4.26.0-6126; ibi Web App: before 4.26.0-6126.
References
psirt@wdc.comhttps://www.westerndigital.com/support/product-security/wdc-23004-western-digital-my-cloud-os-5-my-cloud-home-sandisk-ibi-and-wd-cloud-mobile-and-web-app-updateVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.westerndigital.com/support/product-security/wdc-23004-western-digital-my-cloud-os-5-my-cloud-home-sandisk-ibi-and-wd-cloud-mobile-and-web-app-updateVendor Advisory
Impacted products
Vendor Product Version
westerndigital my_cloud *
westerndigital my_cloud_home *
westerndigital my_cloud_home *
westerndigital my_cloud_home *
westerndigital my_cloud_os_5 *
westerndigital my_cloud_os_5 *
westerndigital sandisk_ibi *
westerndigital sandisk_ibi *
westerndigital sandisk_ibi *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Android",
            "iOS"
          ],
          "product": "My Cloud OS 5 Mobile App",
          "vendor": "Western Digital",
          "versions": [
            {
              "lessThan": "4.21.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "iOS",
            "Android"
          ],
          "product": "My Cloud Home Mobile App",
          "vendor": "Western Digital",
          "versions": [
            {
              "lessThan": "4.21.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Android",
            "iOS"
          ],
          "product": "ibi Mobile App",
          "vendor": "SanDisk",
          "versions": [
            {
              "lessThan": "4.21.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "My Cloud OS 5 Web App",
          "vendor": "Western Digital",
          "versions": [
            {
              "lessThan": " 4.26.0-6126",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "My Cloud Home Web App",
          "vendor": "Western Digital",
          "versions": [
            {
              "lessThan": " 4.26.0-6126",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ibi Web App",
          "vendor": "SanDisk",
          "versions": [
            {
              "lessThan": " 4.26.0-6126",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "psirt@wdc.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:westerndigital:my_cloud:*:*:*:*:*:-:*:*",
              "matchCriteriaId": "DC0CB21B-4285-44F2-901A-C6CD93F02BF2",
              "versionEndExcluding": "4.26.0-6126",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:westerndigital:my_cloud_home:*:*:*:*:*:android:*:*",
              "matchCriteriaId": "70F47505-4CB2-4328-8848-B4CD1783FF0F",
              "versionEndExcluding": "4.21.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:westerndigital:my_cloud_home:*:*:*:*:*:iphone_os:*:*",
              "matchCriteriaId": "269BAE19-1D3F-4895-B016-856D7A0E28F2",
              "versionEndExcluding": "4.21.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:westerndigital:my_cloud_home:*:*:*:*:*:-:*:*",
              "matchCriteriaId": "E9B2EC09-7BEE-419A-82FB-7FF6072ED043",
              "versionEndExcluding": "4.26.0-6126",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:westerndigital:my_cloud_os_5:*:*:*:*:*:android:*:*",
              "matchCriteriaId": "ECA5856B-6962-40B2-BDC3-14E0DA6C53F7",
              "versionEndExcluding": "4.21.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:westerndigital:my_cloud_os_5:*:*:*:*:*:iphone_os:*:*",
              "matchCriteriaId": "3FA5F175-6481-4C41-A394-5F2576C6043C",
              "versionEndExcluding": "4.21.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:westerndigital:sandisk_ibi:*:*:*:*:*:android:*:*",
              "matchCriteriaId": "A432CF3E-836F-4E55-A383-246C9C94A250",
              "versionEndExcluding": "4.21.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:westerndigital:sandisk_ibi:*:*:*:*:*:iphone_os:*:*",
              "matchCriteriaId": "21C1CA69-3797-47BF-8C08-93649D1BF477",
              "versionEndExcluding": "4.21.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:westerndigital:sandisk_ibi:*:*:*:*:*:-:*:*",
              "matchCriteriaId": "8AA2B567-A883-4276-957C-0E90673D1E0E",
              "versionEndExcluding": "4.26.0-6126",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "\n\n\n\n\n\n\n\n\n\nA device API\nendpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile Apps, SanDisk ibi iOS and Android Mobile Apps, My Cloud OS 5 Web App, My Cloud Home Web App and the SanDisk ibi Web App. Due to a permissive CORS policy\nand missing authentication requirement for private IPs, a remote attacker on\nthe same network as the device could obtain device information by convincing a\nvictim user to visit an attacker-controlled server and issue a cross-site\nrequest.\n\n\n\nThis issue affects\nMy Cloud OS 5 Mobile App: before 4.21.0; My Cloud Home Mobile App: before 4.21.0; ibi Mobile App: before 4.21.0; My\nCloud OS 5 Web App: before 4.26.0-6126; My Cloud Home Web App: before 4.26.0-6126;\nibi Web App: before 4.26.0-6126.\n\n"
    }
  ],
  "id": "CVE-2023-22813",
  "lastModified": "2026-06-17T05:36:13.673",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 3.3,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 1.4,
        "source": "psirt@wdc.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-22813",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-01-29T14:52:11.865377Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2023-05-08T23:15:09.897",
  "references": [
    {
      "source": "psirt@wdc.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.westerndigital.com/support/product-security/wdc-23004-western-digital-my-cloud-os-5-my-cloud-home-sandisk-ibi-and-wd-cloud-mobile-and-web-app-update"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.westerndigital.com/support/product-security/wdc-23004-western-digital-my-cloud-os-5-my-cloud-home-sandisk-ibi-and-wd-cloud-mobile-and-web-app-update"
    }
  ],
  "sourceIdentifier": "psirt@wdc.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "psirt@wdc.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.