Path Traversal Arbitrary File Read affects DRYiCE MyXalytics

CVE-2023-45722

Summary

HCL DRYiCE MyXalytics is prone to a path traversal vulnerability that allows for arbitrary file reading. This issue arises due to the application's method of handling external input when constructing file paths, particularly those intended to be confined within a restricted parent directory. The vulnerability stems from inadequate neutralization of special characters in the input, which enables attackers to craft malicious pathnames. If exploited, the attacker could potentially access sensitive files located beyond the intended directory boundaries, which may lead to significant disruptions and unauthorized control over the application.

References