HCL MyXalytics CVE-2025-52657

Exploitation requires an authenticated low-privilege user account in HCL MyXalytics; unauthenticated exploitation is not supported by the CVSS PR:L metric. The attacker must have access to an application input field that is not subject to server-side length validation. Impact is limited to availability degradation (A:L), with no confidentiality or integrity consequence. Limiting factors include: the requirement for a valid application account, the low severity of the resulting availability impact (partial degradation rather than full outage), and the need for repeated or sustained input submission to cause meaningful service disruption. No special non-default configuration is required beyond having user access to the application.

The provided CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) scores this at 3.5 - Low - and the threat picture supports that rating. Exploitation requires an authenticated low-privilege user (PR:L), limiting the attacker pool to existing account holders. The availability impact is rated Low (A:L), indicating degraded rather than complete service disruption. No KEV listing, no public proof-of-concept, and no EPSS data suggesting significant exploitation probability are present. The UI:R metric in the vendor-supplied vector is atypical for a server-side input-flooding DoS - it likely reflects the attacker's own interaction with the input form rather than victim-user interaction - but does not meaningfully change the risk posture. Overall, this is a low-priority finding; it is a nuisance-class vulnerability requiring authenticated access and unlikely to cause catastrophic availability loss.

An authenticated low-privilege user navigates to an input-accepting form or API endpoint within HCL MyXalytics and submits a payload containing an extremely large string - potentially tens of megabytes of character data - causing the backend to allocate and process excessive resources. Repeated submissions could degrade server performance and impact availability for other users. No public exploit code exists, and exploitation requires a valid application account.