Skip to content
Fencer Intel
medium 5.9

CVE-2024-22168 json

Cross-Site Scripting (XSS) vulnerability on Western Digital My Cloud and SanDisk ibi Web Apps

published 2y ago modified 4mo ago also EUVD-2024-19764

cvss
5.9
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 25%
public exploits
0
none known

Summary

A Cross-Site Scripting (XSS) vulnerability on the My Cloud, My Cloud Home, SanDisk ibi, and WD Cloud web apps was found which could allow an attacker to redirect the user to a crafted domain and reset their credentials, or to execute arbitrary client-side code in the user’s browser session to carry out malicious activities.The web apps for these devices have been automatically updated to resolve this vulnerability and improve the security of your devices and data.

Patch / fix

  • Western Digital My Cloud Home web app 4.28.0-102
  • SanDisk ibi web app 4.28.0-102
  • Western Digital WD Cloud web app 4.28.0-102
  • Western Digital My Cloud web app 4.28.0-102
  • western_digital my_cloud_home_web_app 4.28.0-102
  • sandisk ibi_web_app 4.28.0-102
  • western_digital wd_cloud_web_app 4.28.0-102
  • western_digital my_cloud_web_app 4.28.0-102

Is CVE-2024-22168 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2y ago

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 4.0 5.9 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CNA 4.0 5.9 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Western Digital My Cloud Home web app
  • SanDisk ibi web app
  • Western Digital WD Cloud web app
  • Western Digital My Cloud web app
  • western_digital my_cloud_home_web_app
  • sandisk ibi_web_app
  • western_digital wd_cloud_web_app
  • western_digital my_cloud_web_app

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.