by Kastro
Paper/Archive/CVE-2023-45723

CVE-2023-45723

HCL Software DRYiCE MyXalytics — Path Traversal which allows file upload capability affects DRYiCE MyXalytics

EPSS 1.0%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 62.7.627 × 2012.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

HCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability.  Certain endpoints permit users to manipulate the path (including the file name) where these files are stored on the server.

Affected

ProductAffectedFixed inSource
DRYiCE MyXalytics5.9, 6.0, 6.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
HCL (CNA)7.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsupport.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608