Improper Access Control (Controller APIs) affects DRYiCE MyXalytics
CVE-2023-50343

8.3HIGH

Key Information:

Vendor
HCL Software
Status
DRYiCE MyXalytics
Vendor
CVE Published:
3 January 2024

Summary

The HCL DRYiCE MyXalytics product is affected by an improper access control vulnerability, specifically in the Controller APIs. This flaw permits Customer Admin Users to access certain API endpoints that should remain protected, potentially exposing sensitive information related to other users. This vulnerability underlines the importance of stringent access controls and API security measures within the application to safeguard confidential data and maintain user privacy.

Affected Version(s)

DRYiCE MyXalytics 5.9, 6.0, 6.1

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_a...

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.