CVE-2023-22817: fallo de gravedad media en SanDisk ibi
Server-side Request Forgery vulnerability in Western Digital My Cloud, My Cloud Home and SanDisk ibi products
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.5epss 0.2%
Server-side request forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL using another DNS address to point back to the loopback adapter. This could then allow the URL to exploit other vulnerabilities on the local server. This was addressed by fixing DNS addresses that refer to loopback. This issue affects My Cloud OS 5 devices before 5.27.161, My Cloud Home, My Cloud Home Duo and SanDisk ibi devices before 9.5.1-104.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Productos afectados
SanDisk · ibiWestern Digital · My Cloud Home & DuoWestern Digital · My Cloud OS 5CVEs relacionadas — SanDisk ibi
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-29842CRITICALCommand Injection Vulnerability in Western Digital My Cloud devicesEPSS 1.8%CVE-2022-36327MEDIUMPath traversal vulnerability leading to an arbitrary file write in Western Digital devicesEPSS 1.5%CVE-2022-29841HIGHOS Command Injection vulnerability in Western Digital My Cloud devicesEPSS 1.4%CVE-2023-22815MEDIUMPost-authentication remote command injection vulnerability on Western Digital My Cloud OS 5 devicesEPSS 1.3%CVE-2023-22816MEDIUMLimited Post-Authentication Remote Command Injection in My Cloud ProductsEPSS 0.9%CVE-2023-22819MEDIUMUncontrolled resource consumption vulnerability in Western Digital My Cloud, My Cloud Home and SanDisk ibi productsEPSS 0.8%