Mycloud
Monthly
Concurrent Login Vulnerability in HCL MyCloud permits authenticated users to sustain multiple simultaneous active sessions without invalidation, enabling session hijacking and unauthorized account access. The CVSS score of 3.1 (Low) reflects high attack complexity, a prerequisite of authenticated access, and impact confined to partial confidentiality - no integrity or availability impact applies. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis.
TLS session confidentiality in HCL MyCloud is undermined by the LUCKY13 padding oracle vulnerability, enabling a network-positioned attacker to partially decrypt TLS/SSL-protected communications through carefully crafted timing side-channel queries. The flaw stems from non-constant-time MAC processing in CBC-mode cipher suites, a cryptographic weakness first publicly documented in 2013. With a CVSS base score of 3.1 (Low) and high attack complexity, no public exploit code has been identified and the vulnerability has not been added to the CISA KEV catalog, indicating limited immediate threat despite the information disclosure potential.
Session cookie exposure in HCL MyCloud arises from the cookie Path attribute not being set, causing authentication tokens to be transmitted to all paths within the application domain rather than restricted to intended endpoints. The CVSS 2.6 score reflects a genuinely limited-impact finding requiring both high attack complexity and authenticated user interaction to exploit, with only low confidentiality impact and no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis.
HCL MyCloud ships a bundled IIS Server component containing publicly disclosed vulnerabilities, classified under CWE-1104 (Use of Unmaintained Third-Party Components). The CVSS 2.2 score (AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) reflects an extremely constrained attack surface: only a highly privileged attacker navigating high complexity can achieve limited confidentiality disclosure. No public exploit code or active exploitation has been identified at time of analysis.
HCL MyCloud leaks license keys in HTTP responses, enabling authenticated low-privilege users who can observe or intercept the relevant response to capture and misuse the exposed key material. All versions appear affected per CPE wildcard data (cpe:2.3:a:hclsoftware:mycloud:*:*:*:*:*:*:*:*), and the vulnerability is vendor-confirmed via HCL advisory KB0132381. No public exploit code has been identified and the issue is not listed in the CISA KEV catalog, placing overall risk at low severity consistent with the CVSS 3.1 score of 3.1.
Server version disclosure in HCL MyCloud exposes software version strings - likely via HTTP response headers or application-layer output - enabling attackers to fingerprint the exact deployment version and correlate it against public vulnerability databases. The vendor-provided CVSS vector (AV:N/AC:H/PR:H/UI:N) constrains realistic risk significantly: exploitation requires both high privilege and high attack complexity, meaning this is not an opportunistic or mass-exploitable weakness. The vulnerability functions primarily as a reconnaissance enabler for chaining into separate, more severe attacks; no public exploit or active exploitation has been identified at time of analysis.
Weak password policy enforcement in HCL MyCloud exposes authenticated accounts to brute-force and credential-stuffing attacks, potentially enabling unauthorized account takeover. The flaw is classified under CWE-521 (Weak Password Requirements), meaning the platform fails to enforce sufficient password strength constraints on users. Despite tags indicating Information Disclosure risk, no public exploit code or active exploitation has been identified at time of analysis, and the vendor-assigned CVSS score of 3.1 reflects a Low severity rating.
Concurrent Login Vulnerability in HCL MyCloud permits authenticated users to sustain multiple simultaneous active sessions without invalidation, enabling session hijacking and unauthorized account access. The CVSS score of 3.1 (Low) reflects high attack complexity, a prerequisite of authenticated access, and impact confined to partial confidentiality - no integrity or availability impact applies. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis.
TLS session confidentiality in HCL MyCloud is undermined by the LUCKY13 padding oracle vulnerability, enabling a network-positioned attacker to partially decrypt TLS/SSL-protected communications through carefully crafted timing side-channel queries. The flaw stems from non-constant-time MAC processing in CBC-mode cipher suites, a cryptographic weakness first publicly documented in 2013. With a CVSS base score of 3.1 (Low) and high attack complexity, no public exploit code has been identified and the vulnerability has not been added to the CISA KEV catalog, indicating limited immediate threat despite the information disclosure potential.
Session cookie exposure in HCL MyCloud arises from the cookie Path attribute not being set, causing authentication tokens to be transmitted to all paths within the application domain rather than restricted to intended endpoints. The CVSS 2.6 score reflects a genuinely limited-impact finding requiring both high attack complexity and authenticated user interaction to exploit, with only low confidentiality impact and no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis.
HCL MyCloud ships a bundled IIS Server component containing publicly disclosed vulnerabilities, classified under CWE-1104 (Use of Unmaintained Third-Party Components). The CVSS 2.2 score (AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) reflects an extremely constrained attack surface: only a highly privileged attacker navigating high complexity can achieve limited confidentiality disclosure. No public exploit code or active exploitation has been identified at time of analysis.
HCL MyCloud leaks license keys in HTTP responses, enabling authenticated low-privilege users who can observe or intercept the relevant response to capture and misuse the exposed key material. All versions appear affected per CPE wildcard data (cpe:2.3:a:hclsoftware:mycloud:*:*:*:*:*:*:*:*), and the vulnerability is vendor-confirmed via HCL advisory KB0132381. No public exploit code has been identified and the issue is not listed in the CISA KEV catalog, placing overall risk at low severity consistent with the CVSS 3.1 score of 3.1.
Server version disclosure in HCL MyCloud exposes software version strings - likely via HTTP response headers or application-layer output - enabling attackers to fingerprint the exact deployment version and correlate it against public vulnerability databases. The vendor-provided CVSS vector (AV:N/AC:H/PR:H/UI:N) constrains realistic risk significantly: exploitation requires both high privilege and high attack complexity, meaning this is not an opportunistic or mass-exploitable weakness. The vulnerability functions primarily as a reconnaissance enabler for chaining into separate, more severe attacks; no public exploit or active exploitation has been identified at time of analysis.
Weak password policy enforcement in HCL MyCloud exposes authenticated accounts to brute-force and credential-stuffing attacks, potentially enabling unauthorized account takeover. The flaw is classified under CWE-521 (Weak Password Requirements), meaning the platform fails to enforce sufficient password strength constraints on users. Despite tags indicating Information Disclosure risk, no public exploit code or active exploitation has been identified at time of analysis, and the vendor-assigned CVSS score of 3.1 reflects a Low severity rating.