← Vulnerability feed

Vulnerability record · CVE-2023-45722 · published 3 January 2024

CVE-2023-45722: Hcltech dryice myxalytics path traversal vulnerability

Hcltech · Dryice Myxalytics

HCL DRYiCE MyXalytics is impacted by path traversal arbitrary file read vulnerability because it uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory.  The product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Potential exploits can completely disrupt or take over the application.

9.8 CVSS 3.1 Critical EPSS 0.66% · top 50.5% CWE-22 · Path traversal
9.8CVSS 3.1 base score
0.66%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

HCL DRYiCE MyXalytics is impacted by path traversal arbitrary file read vulnerability because it uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory.  The product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Potential exploits can completely disrupt or take over the application.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608 Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109608 Vendor Advisory

Track CVE-2023-45722 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-42180Hcltech dryice myxalytics unrestricted file upload vulnerabilityHCL MyXalytics is affected by a malicious file upload vulnerability. The application accepts invalid file uploads, including incorrect content types,…EPSS 0.26%9.8CVE-2024-42175Hcltech dryice myxalytics improper input validation vulnerabilityHCL MyXalytics is affected by a weak input validation vulnerability. The application accepts special characters and there is no length validation. Th…EPSS 0.28%9.8CVE-2024-42172Hcltech dryice myxalytics improper authentication vulnerabilityHCL MyXalytics is affected by broken authentication. It allows attackers to compromise keys, passwords, and session tokens, potentially leading to id…EPSS 0.39%9.8CVE-2023-50347Hcltech dryice myxalytics sql injection vulnerabilityHCL DRYiCE MyXalytics is impacted by an insecure SQL interface vulnerability, potentially giving an attacker the ability to execute custom SQL querie…EPSS 0.56%9.8CVE-2023-45723Hcltech dryice myxalytics path traversal vulnerabilityHCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability.  Certain endpoints permit users to manipulate …EPSS 1.00%9.8CVE-2023-45724Hcltech dryice myxalytics unrestricted file upload vulnerabilityHCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability. The web application permits the upload of a certain file with…EPSS 0.53%9.4CVE-2024-42168Hcltech dryice myxalytics server-side request forgery (ssrf) vulnerabilityHCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability. An attacker can deploy a web server that returns malicious content, and…EPSS 0.37%9.1CVE-2023-50351Hcltech dryice myxalytics broken cryptographic algorithm vulnerabilityHCL DRYiCE MyXalytics is impacted by the use of an insecure key rotation mechanism which can allow an attacker to compromise the confidentiality or i…EPSS 0.24%

Source: NIST National Vulnerability Database (record CVE-2023-45722), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.