Critical severity · published Jan 11, 2025
CVE-2024-42172
HCL MyXalytics is affected by broken authentication
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
HCL MyXalytics is affected by broken authentication. It allows attackers to compromise keys, passwords, and session tokens, potentially leading to identity theft and system control. This vulnerability arises from poor configuration, logic errors, or software bugs and can affect any application with access control, including databases, network infrastructure, and web applications.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DM
DRYiCE MyXalytics · HCL Software
6.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-42172
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-42172
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149
More from DRYiCE MyXalytics
9.8
CVE-2024-42180
HCL MyXalytics is affected by a malicious file upload vulnerability
9.8
CVE-2024-42175
HCL MyXalytics is affected by a weak input validation vulnerability
9.4
CVE-2024-42168
HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability
8.1
CVE-2024-42169
HCL MyXalytics is affected by insecure direct object references
7.5
CVE-2024-42181
HCL MyXalytics is affected by a cleartext transmission of sensitive information vulnerability