Medium severity · published Jan 3, 2024
CVE-2023-50343
Improper Access Control (Controller APIs) affects DRYiCE MyXalytics
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
HCL DRYiCE MyXalytics is impacted by an Improper Access Control (Controller APIs) vulnerability. Certain API endpoints are accessible to Customer Admin Users that can allow access to sensitive information about other users.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DM
DRYiCE MyXalytics · HCL Software
5.9, 6.0, 6.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-50343
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-50343
Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608
More from DRYiCE MyXalytics
9.8
CVE-2024-42180
HCL MyXalytics is affected by a malicious file upload vulnerability
9.8
CVE-2024-42175
HCL MyXalytics is affected by a weak input validation vulnerability
9.8
CVE-2024-42172
HCL MyXalytics is affected by broken authentication
9.8
CVE-2023-50347
Insecure SQL Interface affects HCL DRYiCE MyXalytics
9.8
CVE-2023-45722
Path Traversal Arbitrary File Read affects DRYiCE MyXalytics