CVE-2024-22168
Cross-Site Scripting (XSS) vulnerability on Western Digital My Cloud and SanDisk ibi Web Apps
- State
- Published
- Severity
- 5.9 Medium
- Published
- Jun 24, 2024
- Updated
- Aug 1, 2024
- Reserved
- Jan 5, 2024
Description
A Cross-Site Scripting (XSS) vulnerability on the My Cloud, My Cloud Home, SanDisk ibi, and WD Cloud web apps was found which could allow an attacker to redirect the user to a crafted domain and reset their credentials, or to execute arbitrary client-side code in the user’s browser session to carry out malicious activities.The web apps for these devices have been automatically updated to resolve this vulnerability and improve the security of your devices and data.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.9 Medium | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | WDC PSIRT |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
My Cloud Home web appWestern Digital |
|
ibi web appSanDisk |
|
WD Cloud web appWestern Digital |
|
My Cloud web appWestern Digital |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.