CVE-2023-22817

Server-side request forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL using another DNS address to point back to the loopback adapter. This could then allow the URL to exploit other vulnerabilities on the local server. This was addressed by fixing DNS addresses that refer to loopback. This issue affects My Cloud OS 5 devices before 5.27.161, My Cloud Home, My Cloud Home Duo and SanDisk ibi devices before 9.5.1-104. 

• CWE-918
• CWE-918

• https://www.westerndigital.com/support/product-security/wdc-24001-western-digital-my-cloud-os-5-my-cloud-home-duo-and-sandisk-ibi-firmware-updateVendor Advisory
• https://www.westerndigital.com/support/product-security/wdc-24001-western-digital-my-cloud-os-5-my-cloud-home-duo-and-sandisk-ibi-firmware-updateVendor Advisory

Published

Feb 5, 2024

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-2281When archiving a team, Mattermost fails to sanitize the rela…4.3
• CVE-2023-22812SanDisk PrivateAccess versions prior to 6.4.9 support insecu…7.4
• CVE-2023-22813 A device API endpoint was missing access controls …4.3
• CVE-2023-22814An authentication bypass issue via spoofing was discovered i…9.8
• CVE-2023-22815Post-authentication remote command injection vulnerability i…6.7
• CVE-2023-22816A post-authentication remote command injection vulnerability…8.8
• CVE-2023-22818Multiple DLL Search Order Hijack vulnerabilities were addres…7.8
• CVE-2023-22819An uncontrolled resource consumption vulnerability issue tha…4.9
• CVE-2023-2282Improper access control in the Web Login listener in Devolut…6.5
• CVE-2023-2283A vulnerability was found in libssh, where the authenticatio…6.5
• CVE-2023-22832The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 thr…7.5
• CVE-2023-22833Palantir Foundry deployments running Lime2 versions between …6.5