CVE-2024-42172: hcl software dryice myxalytics Improper Authentication
Vulnerability summary
CVE-2024-42172 is a critical (CVSS 9.8) Improper Authentication vulnerability in hcl software dryice myxalytics. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.5% of scored vulnerabilities.
Timeline
- 11-01-2025PublishedVulnerability first disclosed.
- 13-01-2025Last modifiedVulnerability information updated.
Description
HCL MyXalytics is affected by broken authentication. It allows attackers to compromise keys, passwords, and session tokens, potentially leading to identity theft and system control. This vulnerability arises from poor configuration, logic errors, or software bugs and can affect any application with access control, including databases, network infrastructure, and web applications.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
33%
Versus all other CVEs
30-day change
+0.01 pp
From 0.39% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Affected systems
Hcl software1 product
Hcltech1 product
2 vendors · 2 products