CVE-2024-22168

Estado: AplazadaMedia (5.9)—

A Cross-Site Scripting (XSS) vulnerability on the My Cloud, My Cloud Home, SanDisk ibi, and WD Cloud web apps was found which could allow an attacker to redirect the user to a crafted domain and reset their credentials, or to execute arbitrary client-side code in the user’s browser session to carry out malicious activities.The web apps for these devices have been automatically updated to resolve this vulnerability and improve the security of your devices and data.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 5.9

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.32%
Percentil entre todas las CVEs puntuadas: 23
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Sandisk — IBI^AI Westerndigital — MY Cloud^AI Westerndigital — MY Cloud Home^AI Westerndigital — WD Cloud^AI

CWE

CWE-79

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2024-22168",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-22168",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-25T14:37:19.734049Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "psirt@wdc.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 5.9,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "ACTIVE",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@wdc.com",
      "affectedData": [
        {
          "vendor": "Western Digital",
          "product": "My Cloud Home web app",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.28.0-102",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "SanDisk",
          "product": "ibi web app",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.28.0-102",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Western Digital",
          "product": "WD Cloud web app",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.28.0-102",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Western Digital",
          "product": "My Cloud web app",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.28.0-102",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:western_digital:my_cloud_home_web_app:*:*:*:*:*:*:*:*"
          ],
          "vendor": "western_digital",
          "product": "my_cloud_home_web_app",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.28.0-102",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:sandisk:ibi_web_app:*:*:*:*:*:*:*:*"
          ],
          "vendor": "sandisk",
          "product": "ibi_web_app",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.28.0-102",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:western_digital:wd_cloud_web_app:*:*:*:*:*:*:*:*"
          ],
          "vendor": "western_digital",
          "product": "wd_cloud_web_app",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.28.0-102",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:western_digital:my_cloud_web_app:*:*:*:*:*:*:*:*"
          ],
          "vendor": "western_digital",
          "product": "my_cloud_web_app",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.28.0-102",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-06-24T23:15:10.417",
  "references": [
    {
      "url": "https://www.westerndigital.com/support/product-security/wdc-24003-western-digital-my-cloud-os-5-my-cloud-home-sandisk-ibi-and-wd-cloud-web-app-update",
      "source": "psirt@wdc.com"
    },
    {
      "url": "https://www.westerndigital.com/support/product-security/wdc-24003-western-digital-my-cloud-os-5-my-cloud-home-sandisk-ibi-and-wd-cloud-web-app-update",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@wdc.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Cross-Site Scripting (XSS) vulnerability on the My Cloud, My Cloud Home, SanDisk ibi, and WD Cloud web apps was found which could allow an attacker to redirect the user to a crafted domain and reset their credentials, or to execute arbitrary client-side code in the user’s browser session to carry out malicious activities.The web apps for these devices have been automatically updated to resolve this vulnerability and improve the security of your devices and data."
    },
    {
      "lang": "es",
      "value": "Se encontró una vulnerabilidad de Cross Site Scripting (XSS) en las aplicaciones web My Cloud, My Cloud Home, SanDisk ibi y WD Cloud que podría permitir a un atacante redirigir al usuario a un dominio manipulado y restablecer sus credenciales, o ejecutar acciones arbitrarias. código del lado del cliente en la sesión del navegador del usuario para llevar a cabo actividades maliciosas. Las aplicaciones web para estos dispositivos se han actualizado automáticamente para resolver esta vulnerabilidad y mejorar la seguridad de sus dispositivos y datos."
    }
  ],
  "lastModified": "2026-06-17T07:10:52.097",
  "sourceIdentifier": "psirt@wdc.com"
}