HCL MyXalytics CVE-2025-52652

Exploitation requires an authenticated session with at least low-privilege credentials in HCL MyXalytics - unauthenticated exploitation is not indicated by the CVSS vector (PR:L). A victim user must interact with or view the page containing the spoofed content (UI:R), meaning the attack is not self-executing. The application must be network-accessible (AV:N). No additional non-default configuration is specified as a prerequisite. Exploitation is limited by: (1) mandatory attacker authentication, (2) required victim interaction, (3) impact confined to integrity only with no confidentiality or availability consequence, and (4) no scope change beyond the vulnerable application session.

The overall risk profile is low. The CVSS 3.5 base score is consistent with the mechanics: exploitation requires a valid low-privilege account and deliberate victim interaction, limiting automated or mass exploitation. EPSS data is not provided, and no public exploit code or CISA KEV listing exists, reinforcing that real-world exploitation remains theoretical at this time. The practical threat is narrow - an attacker would need an internal or application-level account, making this most relevant in multi-tenant or shared-login deployments. Even a mid-sized analytics team relying on MyXalytics should treat this as a routine patch cycle item rather than an emergency response trigger; the constrained scope change (S:U) ensures blast radius stays within the affected session. The sole meaningful impact is integrity (I:L), as reflected in the C:N/A:N CVSS metrics, narrowing the real-world consequence to phishing or social engineering via manipulated UI rather than direct data exfiltration or service disruption.

An authenticated low-privilege user crafts a request or data entry that causes the MyXalytics interface to render attacker-controlled text or UI elements in a context that appears to originate from HCL or an internal authority. A victim user browsing to the affected page sees the spoofed content - for example, a fake credential prompt or fraudulent notification - and is deceived into providing credentials or taking a harmful action. No public proof-of-concept code exists for this vulnerability at time of analysis.