Critical severity · published Jan 3, 2024
CVE-2023-50351
HCL DRYiCE MyXalytics is impacted by the use of an insecure key rotation mechanism which can allow an attacker to compromise the confidentiality or integrity of data
9.1
CVSS
0.2%
EPSS
No
On KEV
Description
HCL DRYiCE MyXalytics is impacted by the use of an insecure key rotation mechanism which can allow an attacker to compromise the confidentiality or integrity of data.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DM
Dryice Myxalytics · Hcltech
5.9; 6.0; 6.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-50351
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-50351
Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608
More from Dryice Myxalytics
9.8
CVE-2024-42180
HCL MyXalytics is affected by a malicious file upload vulnerability
9.8
CVE-2024-42175
HCL MyXalytics is affected by a weak input validation vulnerability
9.8
CVE-2024-42172
HCL MyXalytics is affected by broken authentication
9.8
CVE-2023-50347
Insecure SQL Interface affects HCL DRYiCE MyXalytics
9.8
CVE-2023-45724
HCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability