CVE-2024-42170: medium-severity vulnerability in HCL Software DRYiCE MyXalytics
HCL MyXalytics is affected by a session fixation vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.8epss 0.3%
HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the victim's login session.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected products
HCL Software · DRYiCE MyXalyticsRelated CVEs — HCL Software DRYiCE MyXalytics
In the same product, most dangerous first.
CVE-2023-45723HIGHPath Traversal which allows file upload capability affects DRYiCE MyXalyticsEPSS 1.0%CVE-2023-45722HIGHPath Traversal Arbitrary File Read affects DRYiCE MyXalyticsEPSS 0.7%CVE-2023-50347LOWInsecure SQL Interface affects HCL DRYiCE MyXalyticsEPSS 0.6%CVE-2023-45724HIGHUnauthenticated File Upload affects DRYiCE MyXalyticsEPSS 0.5%CVE-2024-42172MEDIUMHCL MyXalytics is affected by broken authenticationEPSS 0.4%CVE-2023-50343HIGHImproper Access Control (Controller APIs) affects DRYiCE MyXalyticsEPSS 0.4%