Critical severity · published Jan 11, 2025
CVE-2024-42172
HCL MyXalytics is affected by broken authentication
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
HCL MyXalytics is affected by broken authentication. It allows attackers to compromise keys, passwords, and session tokens, potentially leading to identity theft and system control. This vulnerability arises from poor configuration, logic errors, or software bugs and can affect any application with access control, including databases, network infrastructure, and web applications.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DM
Dryice Myxalytics · Hcltech
6.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-42172
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-42172
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149
More from Dryice Myxalytics
9.8
CVE-2024-42180
HCL MyXalytics is affected by a malicious file upload vulnerability
9.8
CVE-2024-42175
HCL MyXalytics is affected by a weak input validation vulnerability
9.8
CVE-2023-50347
HCL DRYiCE MyXalytics is impacted by an insecure SQL interface vulnerability, potentially giving an attacker the ability to execute custom SQL queries
9.8
CVE-2023-45724
HCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability
9.8
CVE-2023-45723
HCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability