Skip to content
Fencer Vulns
medium 5.9

CVE-2024-22168 json

Cross-Site Scripting (XSS) vulnerability on Western Digital My Cloud and SanDisk ibi Web Apps

published 2024-06-24 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-19764

cvss
5.9
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 25%
public exploits
0
none known

Summary

A Cross-Site Scripting (XSS) vulnerability on the My Cloud, My Cloud Home, SanDisk ibi, and WD Cloud web apps was found which could allow an attacker to redirect the user to a crafted domain and reset their credentials, or to execute arbitrary client-side code in the user’s browser session to carry out malicious activities.The web apps for these devices have been automatically updated to resolve this vulnerability and improve the security of your devices and data.

Patch / fix

  • Western Digital My Cloud Home web app 4.28.0-102
  • SanDisk ibi web app 4.28.0-102
  • Western Digital WD Cloud web app 4.28.0-102
  • Western Digital My Cloud web app 4.28.0-102
  • western_digital my_cloud_home_web_app 4.28.0-102
  • sandisk ibi_web_app 4.28.0-102
  • western_digital wd_cloud_web_app 4.28.0-102
  • western_digital my_cloud_web_app 4.28.0-102

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 5.9 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CNA 4.0 5.9 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Western Digital My Cloud Home web app
  • SanDisk ibi web app
  • Western Digital WD Cloud web app
  • Western Digital My Cloud web app
  • western_digital my_cloud_home_web_app
  • sandisk ibi_web_app
  • western_digital wd_cloud_web_app
  • western_digital my_cloud_web_app

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.