← Vulnerability feed

Vulnerability record · CVE-2024-42180 · published 12 January 2025

CVE-2024-42180: Hcltech dryice myxalytics unrestricted file upload vulnerability

Hcltech · Dryice Myxalytics

HCL MyXalytics is affected by a malicious file upload vulnerability. The application accepts invalid file uploads, including incorrect content types, double extensions, null bytes, and special characters, allowing attackers to upload and execute malicious files.

9.8 CVSS 3.1 Critical EPSS 0.26% · top 84.3% CWE-434 · Unrestricted file upload
9.8CVSS 3.1 base score
0.26%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

HCL MyXalytics is affected by a malicious file upload vulnerability. The application accepts invalid file uploads, including incorrect content types, double extensions, null bytes, and special characters, allowing attackers to upload and execute malicious files.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149 Vendor Advisory

Track CVE-2024-42180 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-42175Hcltech dryice myxalytics improper input validation vulnerabilityHCL MyXalytics is affected by a weak input validation vulnerability. The application accepts special characters and there is no length validation. Th…EPSS 0.28%9.8CVE-2024-42172Hcltech dryice myxalytics improper authentication vulnerabilityHCL MyXalytics is affected by broken authentication. It allows attackers to compromise keys, passwords, and session tokens, potentially leading to id…EPSS 0.39%9.8CVE-2023-50347Hcltech dryice myxalytics sql injection vulnerabilityHCL DRYiCE MyXalytics is impacted by an insecure SQL interface vulnerability, potentially giving an attacker the ability to execute custom SQL querie…EPSS 0.56%9.8CVE-2023-45722Hcltech dryice myxalytics path traversal vulnerabilityHCL DRYiCE MyXalytics is impacted by path traversal arbitrary file read vulnerability because it uses external input to construct a pathname that is …EPSS 0.66%9.8CVE-2023-45723Hcltech dryice myxalytics path traversal vulnerabilityHCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability.  Certain endpoints permit users to manipulate …EPSS 1.00%9.8CVE-2023-45724Hcltech dryice myxalytics unrestricted file upload vulnerabilityHCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability. The web application permits the upload of a certain file with…EPSS 0.53%9.4CVE-2024-42168Hcltech dryice myxalytics server-side request forgery (ssrf) vulnerabilityHCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability. An attacker can deploy a web server that returns malicious content, and…EPSS 0.37%9.1CVE-2023-50351Hcltech dryice myxalytics broken cryptographic algorithm vulnerabilityHCL DRYiCE MyXalytics is impacted by the use of an insecure key rotation mechanism which can allow an attacker to compromise the confidentiality or i…EPSS 0.24%

Source: NIST National Vulnerability Database (record CVE-2024-42180), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.