CVE-2023-22813CWE-200

Device API endpoint missing access controls on Western Digital Mobile and Web Apps

Low · published May 8, 2023

CVSS v3.1
3.3
EPSS
0%
Percentile
38.5
In the wild
Unconfirmed
What it is

A device API

endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile Apps, SanDisk ibi iOS and Android Mobile Apps, My Cloud OS 5 Web App, My Cloud Home Web App and the SanDisk ibi Web App. Due to a permissive CORS policy

and missing authentication requirement for private IPs, a remote attacker on

the same network as the device could obtain device information by convincing a

victim user to visit an attacker-controlled server and issue a cross-site

request.

This issue affects

My Cloud OS 5 Mobile App: before 4.21.0; My Cloud Home Mobile App: before 4.21.0; ibi Mobile App: before 4.21.0; My

Cloud OS 5 Web App: before 4.26.0-6126; My Cloud Home Web App: before 4.26.0-6126;

ibi Web App: before 4.26.0-6126.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00455 · 38.5th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2023-05-08T22:56Z
EPSS history
Timeline
  • 08 MAY 22:56Z
    Device API endpoint missing access controls on Western Digital Mobile and Web Apps
    cvelistv5