by Kastro
Paper/Archive/CVE-2024-42180

CVE-2024-42180

HCL Software DRYiCE MyXalytics — HCL MyXalytics is affected by a malicious file upload vulnerability

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
33
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 17.9.179 × 203.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

HCL MyXalytics is affected by a malicious file upload vulnerability. The application accepts invalid file uploads, including incorrect content types, double extensions, null bytes, and special characters, allowing attackers to upload and execute malicious files.

Affected

ProductAffectedFixed inSource
DRYiCE MyXalytics6.3–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
HCL (CNA)1.6CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refsupport.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149