EUVD-2026-46345
GHSA-2f42-pwwp-mp54
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
LUCKY13 is a network TLS-layer timing attack requiring no authentication; AC:H reflects MitM requirement and oracle complexity; C:L for partial plaintext recovery only.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
1DescriptionCVE.org
HCL MyCloud was affected by the SSL/TLS LUCKY13 Vulnerability. An attacker may exploit this vulnerability to decrypt sensitive information through a TLS/SSL padding oracle attack.
AnalysisAI
TLS session confidentiality in HCL MyCloud is undermined by the LUCKY13 padding oracle vulnerability, enabling a network-positioned attacker to partially decrypt TLS/SSL-protected communications through carefully crafted timing side-channel queries. The flaw stems from non-constant-time MAC processing in CBC-mode cipher suites, a cryptographic weakness first publicly documented in 2013. With a CVSS base score of 3.1 (Low) and high attack complexity, no public exploit code has been identified and the vulnerability has not been added to the CISA KEV catalog, indicating limited immediate threat despite the information disclosure potential.
Technical ContextAI
LUCKY13 is a timing side-channel attack against TLS/SSL implementations using CBC-mode cipher suites with MAC-then-encrypt construction. The attack exploits measurable differences in server processing time when handling TLS records with varying amounts of CBC padding, effectively creating a padding oracle. CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) captures the root cause: reliance on cryptographic constructs whose security properties have been formally broken. The affected product is identified via CPE cpe:2.3:a:hclsoftware:mycloud:*:*:*:*:*:*:*:*, indicating all tracked versions of HCL MyCloud from HCL Software (formerly IBM). Mitigation requires either constant-time MAC processing, disabling CBC cipher suites in favor of AEAD modes (e.g., AES-GCM), or enforcing TLS 1.3, which eliminates CBC-mode padding oracles by design.
RemediationAI
Consult the HCL Software advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132381 for the primary fix guidance, as no specific patched version number is confirmed in the available intelligence data - patch availability per vendor advisory should be assumed pending review of the KB article. As a compensating control pending patch application, administrators should disable all CBC-mode TLS cipher suites in the MyCloud TLS configuration and enforce AEAD-only suites such as AES-128-GCM-SHA256 or AES-256-GCM-SHA384; note this may break compatibility with legacy TLS 1.0/1.1 clients. Enforcing TLS 1.3 exclusively eliminates the CBC padding oracle attack surface entirely but requires all clients to support TLS 1.3. Network-level mitigations such as restricting TLS endpoints to trusted network segments reduce MitM opportunity but do not eliminate the underlying cryptographic weakness.
Weak password policy enforcement in HCL MyCloud exposes authenticated accounts to brute-force and credential-stuffing at
HCL MyCloud leaks license keys in HTTP responses, enabling authenticated low-privilege users who can observe or intercep
Concurrent Login Vulnerability in HCL MyCloud permits authenticated users to sustain multiple simultaneous active sessio
Session cookie exposure in HCL MyCloud arises from the cookie Path attribute not being set, causing authentication token
HCL MyCloud ships a bundled IIS Server component containing publicly disclosed vulnerabilities, classified under CWE-110
Server version disclosure in HCL MyCloud exposes software version strings - likely via HTTP response headers or applicat
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today