CVE-2023-45722: high-severity vulnerability in HCL Software DRYiCE MyXalytics
Path Traversal Arbitrary File Read affects DRYiCE MyXalytics
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
DRYiCE MyXalytics has a flaw that allows attackers to read files anywhere on the server by manipulating file paths. An attacker can bypass protections and access sensitive data like passwords or configuration files.
Path traversal vulnerability (CWE-22) in DRYiCE MyXalytics resulting from insufficient sanitization of user-supplied pathname input. An unauthenticated or authenticated attacker can craft special characters in file path parameters to escape the intended directory restrictions and read arbitrary files on the system, potentially exposing credentials and system configuration.
In the same product, most dangerous first.