Device API endpoint missing access controls on Western Digital Mobile and Web Apps
A device API
endpoint was missing access controls on Western Digital My Cloud OS 5 iOS and Anroid Mobile Apps, My Cloud Home iOS and Android Mobile Apps, SanDisk ibi iOS and Android Mobile Apps, My Cloud OS 5 Web App, My Cloud Home Web App and the SanDisk ibi Web App. Due to a permissive CORS policy
and missing authentication requirement for private IPs, a remote attacker on
the same network as the device could obtain device information by convincing a
victim user to visit an attacker-controlled server and issue a cross-site
request.
This issue affects
My Cloud OS 5 Mobile App: before 4.21.0; My Cloud Home Mobile App: before 4.21.0; ibi Mobile App: before 4.21.0; My
Cloud OS 5 Web App: before 4.26.0-6126; My Cloud Home Web App: before 4.26.0-6126;
ibi Web App: before 4.26.0-6126.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
My Cloud OS 5 Mobile App
Vendor
Western Digital
Product
My Cloud OS 5 Mobile App
Platforms
Android
iOS
Default status
unaffected
My Cloud OS 5 Mobile App · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
4.21.0
Unavailable
None listed
My Cloud Home Mobile App
Vendor
Western Digital
Product
My Cloud Home Mobile App
Platforms
iOS
Android
Default status
unaffected
My Cloud Home Mobile App · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
4.21.0
Unavailable
None listed
ibi Mobile App
Vendor
SanDisk
Product
ibi Mobile App
Platforms
Android
iOS
Default status
unaffected
ibi Mobile App · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
4.21.0
Unavailable
None listed
My Cloud OS 5 Web App
Vendor
Western Digital
Product
My Cloud OS 5 Web App
Platforms
Unknown
Default status
unaffected
My Cloud OS 5 Web App · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
4.26.0-6126
Unavailable
None listed
My Cloud Home Web App
Vendor
Western Digital
Product
My Cloud Home Web App
Platforms
Unknown
Default status
unaffected
My Cloud Home Web App · Scoped product and version facts