CVE-2023-22813

A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile Apps, SanDisk ibi iOS and Android Mobile Apps, My Cloud OS 5 Web App, My Cloud Home Web App and the SanDisk ibi Web App. Due to a permissive CORS policy and missing authentication requirement for private IPs, a remote attacker on the same network as the device could obtain device information by convincing a victim user to visit an attacker-controlled server and issue a cross-site request. This issue affects My Cloud OS 5 Mobile App: before 4.21.0; My Cloud Home Mobile App: before 4.21.0; ibi Mobile App: before 4.21.0; My Cloud OS 5 Web App: before 4.26.0-6126; My Cloud Home Web App: before 4.26.0-6126; ibi Web App: before 4.26.0-6126.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.westerndigital.com/support/product-security/wdc-23004-western-digital-my-cloud-os-5-my-cloud-home-sandisk-ibi-and-wd-cloud-mobile-and-web-app-update	Vendor Advisory
https://www.westerndigital.com/support/product-security/wdc-23004-western-digital-my-cloud-os-5-my-cloud-home-sandisk-ibi-and-wd-cloud-mobile-and-web-app-update	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:westerndigital:my_cloud::::::-::*
	cpe:2.3:a:westerndigital:my_cloud_home::::::android::*
	cpe:2.3:a:westerndigital:my_cloud_home::::::iphone_os::*
	cpe:2.3:a:westerndigital:my_cloud_home::::::-::*
	cpe:2.3:a:westerndigital:my_cloud_os_5::::::android::*
	cpe:2.3:a:westerndigital:my_cloud_os_5::::::iphone_os::*
	cpe:2.3:a:westerndigital:sandisk_ibi::::::android::*
	cpe:2.3:a:westerndigital:sandisk_ibi::::::iphone_os::*
	cpe:2.3:a:westerndigital:sandisk_ibi::::::-::*

History

21 Nov 2024, 07:45

Type	Values Removed	Values Added
References	~~() https://www.westerndigital.com/support/product-security/wdc-23004-western-digital-my-cloud-os-5-my-cloud-home-sandisk-ibi-and-wd-cloud-mobile-and-web-app-update - Vendor Advisory~~	() https://www.westerndigital.com/support/product-security/wdc-23004-western-digital-my-cloud-os-5-my-cloud-home-sandisk-ibi-and-wd-cloud-mobile-and-web-app-update - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~4.3~~	v2 : unknown v3 : 3.3

16 May 2023, 15:01

Type	Values Removed	Values Added
CWE		CWE-862
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.3
CPE		cpe:2.3:a:westerndigital:sandisk_ibi::::::iphone_os::* cpe:2.3:a:westerndigital:my_cloud_os_5::::::iphone_os::* cpe:2.3:a:westerndigital:my_cloud_os_5::::::android::* cpe:2.3:a:westerndigital:my_cloud::::::-::* cpe:2.3:a:westerndigital:my_cloud_home::::::android::* cpe:2.3:a:westerndigital:sandisk_ibi::::::android::* cpe:2.3:a:westerndigital:my_cloud_home::::::-::* cpe:2.3:a:westerndigital:sandisk_ibi::::::-::* cpe:2.3:a:westerndigital:my_cloud_home::::::iphone_os::*
References	~~(MISC) https://www.westerndigital.com/support/product-security/wdc-23004-western-digital-my-cloud-os-5-my-cloud-home-sandisk-ibi-and-wd-cloud-mobile-and-web-app-update -~~	(MISC) https://www.westerndigital.com/support/product-security/wdc-23004-western-digital-my-cloud-os-5-my-cloud-home-sandisk-ibi-and-wd-cloud-mobile-and-web-app-update - Vendor Advisory

10 May 2023, 22:15

Type	Values Removed	Values Added
Summary	A device API endpoint was missing access controls on Western Digital My Cloud OS 5 Mobile App on Android, iOS, Western Digital My Cloud Home Mobile App on iOS, Android, SanDIsk ibi Mobile App on Android, iOS, Western Digital WD Cloud Mobile App on Android, iOS, Western Digital My Cloud OS 5 Web App, Western Digital My Cloud Home Web App, SanDisk ibi Web App and the Western Digital WD Web App. Due to a permissive CORS policy and missing authentication requirement for private IPs, a remote attacker on the same network as the device could obtain device information by convincing a victim user to visit an attacker-controlled server and issue a cross-site request.This issue affects My Cloud OS 5 Mobile App: through 4.21.0; My Cloud Home Mobile App: through 4.21.0; ibi Mobile App: through 4.21.0; WD Cloud Mobile App: through 4.21.0; My Cloud OS 5 Web App: through 4.26.0-6126; My Cloud Home Web App: through 4.26.0-6126; ibi Web App: through 4.26.0-6126; WD Web App: through 4.26.0-6126.	A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile Apps, SanDisk ibi iOS and Android Mobile Apps, My Cloud OS 5 Web App, My Cloud Home Web App and the SanDisk ibi Web App. Due to a permissive CORS policy and missing authentication requirement for private IPs, a remote attacker on the same network as the device could obtain device information by convincing a victim user to visit an attacker-controlled server and issue a cross-site request. This issue affects My Cloud OS 5 Mobile App: before 4.21.0; My Cloud Home Mobile App: before 4.21.0; ibi Mobile App: before 4.21.0; My Cloud OS 5 Web App: before 4.26.0-6126; My Cloud Home Web App: before 4.26.0-6126; ibi Web App: before 4.26.0-6126.

08 May 2023, 23:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-05-08 23:15

Updated : 2024-11-21 07:45

NVD link : CVE-2023-22813

Mitre link : CVE-2023-22813

CVE.ORG link : CVE-2023-22813

JSON object : View

Products Affected

westerndigital

my_cloud_os_5
my_cloud_home
sandisk_ibi
my_cloud

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-862

Missing Authorization

{"id": "CVE-2023-22813", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@wdc.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2023-05-08T23:15:09.897", "references": [{"url": "https://www.westerndigital.com/support/product-security/wdc-23004-western-digital-my-cloud-os-5-my-cloud-home-sandisk-ibi-and-wd-cloud-mobile-and-web-app-update", "tags": ["Vendor Advisory"], "source": "psirt@wdc.com"}, {"url": "https://www.westerndigital.com/support/product-security/wdc-23004-western-digital-my-cloud-os-5-my-cloud-home-sandisk-ibi-and-wd-cloud-mobile-and-web-app-update", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "psirt@wdc.com", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "\n\n\n\n\n\n\n\n\n\nA device API\nendpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile Apps, SanDisk ibi iOS and Android Mobile Apps, My Cloud OS 5 Web App, My Cloud Home Web App and the SanDisk ibi Web App. Due to a permissive CORS policy\nand missing authentication requirement for private IPs, a remote attacker on\nthe same network as the device could obtain device information by convincing a\nvictim user to visit an attacker-controlled server and issue a cross-site\nrequest.\n\n\n\nThis issue affects\nMy Cloud OS 5 Mobile App: before 4.21.0; My Cloud Home Mobile App: before 4.21.0; ibi Mobile App: before 4.21.0; My\nCloud OS 5 Web App: before 4.26.0-6126; My Cloud Home Web App: before 4.26.0-6126;\nibi Web App: before 4.26.0-6126.\n\n"}], "lastModified": "2024-11-21T07:45:28.070", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:westerndigital:my_cloud:*:*:*:*:*:-:*:*", "vulnerable": true, "matchCriteriaId": "DC0CB21B-4285-44F2-901A-C6CD93F02BF2", "versionEndExcluding": "4.26.0-6126"}, {"criteria": "cpe:2.3:a:westerndigital:my_cloud_home:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "70F47505-4CB2-4328-8848-B4CD1783FF0F", "versionEndExcluding": "4.21.0"}, {"criteria": "cpe:2.3:a:westerndigital:my_cloud_home:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "269BAE19-1D3F-4895-B016-856D7A0E28F2", "versionEndExcluding": "4.21.0"}, {"criteria": "cpe:2.3:a:westerndigital:my_cloud_home:*:*:*:*:*:-:*:*", "vulnerable": true, "matchCriteriaId": "E9B2EC09-7BEE-419A-82FB-7FF6072ED043", "versionEndExcluding": "4.26.0-6126"}, {"criteria": "cpe:2.3:a:westerndigital:my_cloud_os_5:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "ECA5856B-6962-40B2-BDC3-14E0DA6C53F7", "versionEndExcluding": "4.21.0"}, {"criteria": "cpe:2.3:a:westerndigital:my_cloud_os_5:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "3FA5F175-6481-4C41-A394-5F2576C6043C", "versionEndExcluding": "4.21.0"}, {"criteria": "cpe:2.3:a:westerndigital:sandisk_ibi:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "A432CF3E-836F-4E55-A383-246C9C94A250", "versionEndExcluding": "4.21.0"}, {"criteria": "cpe:2.3:a:westerndigital:sandisk_ibi:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "21C1CA69-3797-47BF-8C08-93649D1BF477", "versionEndExcluding": "4.21.0"}, {"criteria": "cpe:2.3:a:westerndigital:sandisk_ibi:*:*:*:*:*:-:*:*", "vulnerable": true, "matchCriteriaId": "8AA2B567-A883-4276-957C-0E90673D1E0E", "versionEndExcluding": "4.26.0-6126"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@wdc.com"}

3.3 /10