CVE-2024-42169
Published: 11 January 2025
Description
HCL MyXalytics is affected by insecure direct object references. It occurs due to missing access control checks, which fail to verify whether a user should be allowed to access specific data.
Security Summary
CVE-2024-42169 is an insecure direct object reference (IDOR) vulnerability in HCL MyXalytics, stemming from missing access control checks that fail to verify whether a user is authorized to access specific data. Mapped to CWE-639, it carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), indicating high severity due to its potential for unauthorized data manipulation.
The vulnerability can be exploited by low-privileged authenticated users (PR:L) over the network (AV:N) with low attack complexity and no user interaction required. Successful exploitation enables high integrity impact (I:H), such as unauthorized modification of data, alongside low confidentiality impact (C:L) through unauthorized access to sensitive information, without affecting availability.
HCL's advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149 details mitigation steps and patches for addressing the issue in HCL MyXalytics.
Details
- CWE(s)