Critical severity · published Jan 12, 2025
CVE-2024-42180
HCL MyXalytics is affected by a malicious file upload vulnerability
9.8
CVSS
0.3%
EPSS
No
On KEV
Description
HCL MyXalytics is affected by a malicious file upload vulnerability. The application accepts invalid file uploads, including incorrect content types, double extensions, null bytes, and special characters, allowing attackers to upload and execute malicious files.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DM
DRYiCE MyXalytics · HCL Software
6.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-42180
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-42180
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149
More from DRYiCE MyXalytics
9.8
CVE-2024-42175
HCL MyXalytics is affected by a weak input validation vulnerability
9.8
CVE-2024-42172
HCL MyXalytics is affected by broken authentication
9.8
CVE-2023-50347
Insecure SQL Interface affects HCL DRYiCE MyXalytics
9.4
CVE-2024-42168
HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability
8.1
CVE-2024-42169
HCL MyXalytics is affected by insecure direct object references