Critical severity · published Jan 12, 2025
CVE-2024-42180
HCL MyXalytics is affected by a malicious file upload vulnerability
9.8
CVSS
0.3%
EPSS
No
On KEV
Description
HCL MyXalytics is affected by a malicious file upload vulnerability. The application accepts invalid file uploads, including incorrect content types, double extensions, null bytes, and special characters, allowing attackers to upload and execute malicious files.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DM
Dryice Myxalytics · Hcltech
6.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-42180
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-42180
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149
More from Dryice Myxalytics
9.8
CVE-2024-42175
HCL MyXalytics is affected by a weak input validation vulnerability
9.8
CVE-2024-42172
HCL MyXalytics is affected by broken authentication
9.8
CVE-2023-50347
HCL DRYiCE MyXalytics is impacted by an insecure SQL interface vulnerability, potentially giving an attacker the ability to execute custom SQL queries
9.8
CVE-2023-45724
HCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability
9.8
CVE-2023-45723
HCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability