Improper Password Policy in HCL MyXalytics Allows Brute-Force Attacks

CVE-2024-42173

Summary

HCL MyXalytics has a vulnerability related to improper implementation of its password policy. This flaw enables attackers to exploit weak password choices and the absence of account lockout mechanisms, making it feasible to guess or conduct brute-force attacks on user accounts when the corresponding username is known. Organizations using HCL MyXalytics should review their password policies and consider implementing stronger password requirements and lockout protocols to mitigate this risk.

References