HCL MyXalytics EUVD-2025-210859

Exploitation requires an authenticated session with at least low-privileged access to the HCL MyXalytics application (PR:L per CVSS). User interaction is required (UI:R), meaning the flaw is not exploitable purely via automated or passive requests - a user must perform some action within the application. No confidentiality impact is achievable. Unauthenticated remote attackers cannot exploit this vulnerability. The specific input field, endpoint, or workflow affected is not disclosed in the available description or references, limiting precise defensive scoping.

Real-world risk is low. The CVSS base score of 3.5 accurately reflects the constrained exploitation model: attackers must be authenticated (PR:L) and the vulnerability requires user interaction (UI:R), ruling out automated or unauthenticated mass exploitation. The impact is limited to low integrity modification (I:L) with no confidentiality or availability consequences (C:N/A:N). No KEV listing, no public exploit code, and a low EPSS-class profile all align to confirm this is not an active exploitation target. The 'Information Disclosure' tag applied to this CVE directly conflicts with the CVSS C:N metric, suggesting a metadata labeling error. The vague vendor description ('unintended system behaviour or security issues') limits independent technical assessment; the true nature of the input injection vector and reachable data surface is not confirmed from available sources.

An authenticated user with low-privilege credentials navigates to a data entry or analytics configuration interface in HCL MyXalytics and submits specially crafted input that bypasses application-side validation. This triggers unintended processing behavior, potentially modifying application data or configuration state at a low severity level. No public proof-of-concept exists, making opportunistic exploitation unlikely.