Vulnerability Details : CVE-2023-22813
A device API
endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile Apps, SanDisk ibi iOS and Android Mobile Apps, My Cloud OS 5 Web App, My Cloud Home Web App and the SanDisk ibi Web App. Due to a permissive CORS policy
and missing authentication requirement for private IPs, a remote attacker on
the same network as the device could obtain device information by convincing a
victim user to visit an attacker-controlled server and issue a cross-site
request.
This issue affects
My Cloud OS 5 Mobile App: before 4.21.0; My Cloud Home Mobile App: before 4.21.0; ibi Mobile App: before 4.21.0; My
Cloud OS 5 Web App: before 4.26.0-6126; My Cloud Home Web App: before 4.26.0-6126;
ibi Web App: before 4.26.0-6126.
Vulnerability category: Information leak
Products affected by CVE-2023-22813
- cpe:2.3:a:westerndigital:my_cloud:*:*:*:*:*:-:*:*
- cpe:2.3:a:westerndigital:my_cloud_home:*:*:*:*:*:iphone_os:*:*
- cpe:2.3:a:westerndigital:my_cloud_home:*:*:*:*:*:android:*:*
- cpe:2.3:a:westerndigital:my_cloud_home:*:*:*:*:*:-:*:*
- cpe:2.3:a:westerndigital:sandisk_ibi:*:*:*:*:*:iphone_os:*:*
- cpe:2.3:a:westerndigital:sandisk_ibi:*:*:*:*:*:-:*:*
- cpe:2.3:a:westerndigital:sandisk_ibi:*:*:*:*:*:android:*:*
- cpe:2.3:a:westerndigital:my_cloud_os_5:*:*:*:*:*:iphone_os:*:*
- cpe:2.3:a:westerndigital:my_cloud_os_5:*:*:*:*:*:android:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-22813
0.14%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 31 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-22813
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |
2.8
|
1.4
|
NIST | |
|
3.3
|
LOW | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |
1.8
|
1.4
|
Western Digital |
CWE ids for CVE-2023-22813
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: psirt@wdc.com (Secondary)
-
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.Assigned by: nvd@nist.gov (Primary)
References for CVE-2023-22813
-
https://www.westerndigital.com/support/product-security/wdc-23004-western-digital-my-cloud-os-5-my-cloud-home-sandisk-ibi-and-wd-cloud-mobile-and-web-app-update
WDC-23004 Western Digital My Cloud OS 5, My Cloud Home, SanDisk ibi and WD Cloud Mobile and Web App Update | Western DigitalVendor Advisory
Jump to