EUVD-2025-210859
GHSA-frcx-2mrg-6xg4
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Network-reachable but requires authenticated low-privilege session and user interaction; impact is integrity-only at low severity, no confidentiality or availability consequence.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
2DescriptionCVE.org
HCL MyXalytics was affected by Improper Input validation Vulnerability. It allow malicious or unexpected data to cause unintended system behaviour or security issues.
AnalysisAI
Improper input validation in HCL MyXalytics allows an authenticated low-privileged user to submit malicious or unexpected data through the application, causing unintended system behavior or minor integrity-affecting outcomes. The CVSS vector (PR:L/UI:R/I:L) indicates exploitation requires both an authenticated session and user interaction, with impact limited to low-level integrity modification and no confidentiality exposure. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
CWE-20 (Improper Input Validation) describes a failure to validate or sanitize user-supplied input before it is processed by the application. In web-based analytics platforms like HCL MyXalytics (CPE: cpe:2.3:a:hcl_software:myxalytics:*:*:*:*:*:*:*:*), this class of flaw typically manifests in form fields, API parameters, or data import workflows where user-controlled values are passed to backend logic without sufficient bounds or format checking. The wildcard CPE version field indicates HCL has not disclosed the specific affected version range in the available NVD/CPE data. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N confirms the vulnerability is reachable over the network but limited in practical impact.
RemediationAI
Consult HCL Software's advisory KB0132828 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132828 for the specific patched version and update instructions. No exact fix version is independently confirmed from available CPE or reference data. As a compensating control while patching, restrict access to the affected HCL MyXalytics instance to authenticated corporate users only, enforce least-privilege account policies so low-privilege accounts cannot reach sensitive input paths, and apply web application firewall rules to reject anomalous input patterns at the perimeter.
More in Myxalytics
View allHCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secr
HCL MyXalytics is susceptible to a low-severity denial-of-service condition via unrestricted character input in user-fac
Content spoofing in HCL MyXalytics (CWE-451) enables an authenticated, low-privileged attacker to inject manipulated con
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today