VYPR
← All advisories
Low severity3.3NVD Advisory· Published May 8, 2023· Updated Jun 17, 2026

CVE-2023-22813

CVE-2023-22813

Description

A device API endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile Apps, SanDisk ibi iOS and Android Mobile Apps, My Cloud OS 5 Web App, My Cloud Home Web App and the SanDisk ibi Web App. Due to a permissive CORS policy and missing authentication requirement for private IPs, a remote attacker on the same network as the device could obtain device information by convincing a victim user to visit an attacker-controlled server and issue a cross-site request.

This issue affects My Cloud OS 5 Mobile App: before 4.21.0; My Cloud Home Mobile App: before 4.21.0; ibi Mobile App: before 4.21.0; My Cloud OS 5 Web App: before 4.26.0-6126; My Cloud Home Web App: before 4.26.0-6126; ibi Web App: before 4.26.0-6126.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

20
  • Westerndigital/My Cloud
    cpe:2.3:a:westerndigital:my_cloud:*:*:*:*:*:-:*:*
    Range: <4.26.0-6126
  • Westerndigital/My Cloud Home4 versions
    cpe:2.3:a:westerndigital:my_cloud_home:*:*:*:*:*:-:*:*+ 3 more
    • cpe:2.3:a:westerndigital:my_cloud_home:*:*:*:*:*:-:*:*range: <4.26.0-6126
    • cpe:2.3:a:westerndigital:my_cloud_home:*:*:*:*:*:android:*:*range: <4.21.0
    • cpe:2.3:a:westerndigital:my_cloud_home:*:*:*:*:*:iphone_os:*:*range: <4.21.0
    • (no CPE)range: <4.21.0
  • Westerndigital/My Cloud OS 53 versions
    cpe:2.3:a:westerndigital:my_cloud_os_5:*:*:*:*:*:android:*:*+ 2 more
    • cpe:2.3:a:westerndigital:my_cloud_os_5:*:*:*:*:*:android:*:*range: <4.21.0
    • cpe:2.3:a:westerndigital:my_cloud_os_5:*:*:*:*:*:iphone_os:*:*range: <4.21.0
    • (no CPE)range: <4.21.0
  • Westerndigital/Sandisk Ibi4 versions
    cpe:2.3:a:westerndigital:sandisk_ibi:*:*:*:*:*:-:*:*+ 3 more
    • cpe:2.3:a:westerndigital:sandisk_ibi:*:*:*:*:*:-:*:*range: <4.26.0-6126
    • cpe:2.3:a:westerndigital:sandisk_ibi:*:*:*:*:*:android:*:*range: <4.21.0
    • cpe:2.3:a:westerndigital:sandisk_ibi:*:*:*:*:*:iphone_os:*:*range: <4.21.0
    • (no CPE)range: <4.26.0-6126
  • Westerndigital/SanDisk ibi Mobile Appllm-create
    Range: <4.21.0
  • Westerndigital/My Cloud Web Appllm-fuzzy
    Range: <4.26.0-6126
  • SanDisk/ibi Mobile Appv5
    Range: 0
  • SanDisk/ibi Web Appv5
    Range: 0
  • Western Digital/My Cloud Home Mobile Appv5
    Range: 0
  • Western Digital/My Cloud Home Web Appv5
    Range: 0
  • Western Digital/My Cloud OS 5 Mobile Appv5
    Range: 0
  • Western Digital/My Cloud OS 5 Web Appv5
    Range: 0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.