CVE-2024-42168

HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability. An attacker can deploy a web server that returns malicious content, and then induce the application to retrieve and process that content.

CVSS v3 8.9 HIGH

8.9^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hcltech:dryice_myxalytics:6.3:*:*:*:*:*:*:*

History

16 May 2025, 13:46

Type	Values Removed	Values Added
First Time		Hcltech Hcltech dryice Myxalytics
Summary		(es) HCL MyXalytics se ve afectado por una vulnerabilidad de carga de recursos fuera de banda (HTTP). Un atacante puede implementar un servidor web que devuelva contenido malicioso y luego inducir a la aplicación a recuperar y procesar ese contenido.
CWE		CWE-918
References	~~() https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149 -~~	() https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149 - Vendor Advisory
CPE		cpe:2.3:a:hcltech:dryice_myxalytics:6.3:::::::*

11 Jan 2025, 03:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-01-11 03:15

Updated : 2025-05-16 13:46

NVD link : CVE-2024-42168

Mitre link : CVE-2024-42168

CVE.ORG link : CVE-2024-42168

JSON object : View

Products Affected

hcltech

dryice_myxalytics

CWE

CWE-610

Externally Controlled Reference to a Resource in Another Sphere

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2024-42168", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.9, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 3.9}]}, "published": "2025-01-11T03:15:21.737", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-610"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "HCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability. An attacker can deploy a web server that returns malicious content, and then induce the application to retrieve and process that content."}, {"lang": "es", "value": "HCL MyXalytics se ve afectado por una vulnerabilidad de carga de recursos fuera de banda (HTTP). Un atacante puede implementar un servidor web que devuelva contenido malicioso y luego inducir a la aplicaci\u00f3n a recuperar y procesar ese contenido."}], "lastModified": "2025-05-16T13:46:43.763", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:dryice_myxalytics:6.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0C92689D-384F-41F5-9E28-517A968FAD9E"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}

8.9 /10