EUVD-2025-210860
GHSA-f55g-q59m-w2xx
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Network-accessible but requires authenticated low-privilege account and victim interaction; impact is integrity-only (spoofed content), with no confidentiality or availability effect.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
2DescriptionCVE.org
HCL MyXalytics was affected by Content Spoofing Vulnerability. It may allow an attacker to manipulate displayed content, making it appear as though it originates from a trusted source, potentially leading to phishing or data theft.
AnalysisAI
Content spoofing in HCL MyXalytics (CWE-451) enables an authenticated, low-privileged attacker to inject manipulated content into the application's user interface, causing it to appear as though the content originates from a trusted source. The vulnerability requires victim interaction - a user must view the attacker-influenced page - and carries a CVSS 3.5 (Low) base score, reflecting its constrained impact on integrity only with no confidentiality or availability effects. No public exploit code or active exploitation has been identified; the primary real-world concern is phishing and social engineering facilitated through the spoofed interface.
Technical ContextAI
CWE-451 (User Interface Misrepresentation of Critical Information) describes a class of vulnerabilities where an application fails to adequately distinguish between trusted and untrusted content when rendering its interface, enabling an attacker to inject or alter visible content in a way that deceives users about its origin or legitimacy. HCL MyXalytics is a business analytics platform produced by HCL Software (CPE: cpe:2.3:a:hcl_software:myxalytics:*:*:*:*:*:*:*:*). The wildcard version in the CPE indicates that the scope of affected versions has not been narrowed by NVD - all tracked releases may be affected. The attack surface is network-accessible (AV:N) but requires an authenticated session (PR:L) and a victim who interacts with the spoofed content (UI:R), placing this squarely in the category of authenticated UI-injection/content-spoofing rather than unauthenticated input injection.
RemediationAI
The primary remediation is to consult and apply guidance from the HCL Software advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132828. No exact fixed version number is discernible from the available input data, so administrators should review the advisory directly to identify the patched release. As a compensating control pending patching, restricting access to the MyXalytics application to known-trusted, authenticated users and enforcing least-privilege on account provisioning reduces the pool of potential attackers. Monitoring for anomalous or unexpected content rendered in application pages - particularly in shared or multi-user deployments - may help detect exploitation attempts. Input validation and output encoding hardening at the application layer, if configurable, would reduce the exploitable surface.
More in Myxalytics
View allHCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secr
HCL MyXalytics is susceptible to a low-severity denial-of-service condition via unrestricted character input in user-fac
Improper input validation in HCL MyXalytics allows an authenticated low-privileged user to submit malicious or unexpecte
Share
External POC / Exploit Code
Leaving vuln.today