// For flags

CVE-2023-45722

Path Traversal Arbitrary File Read affects DRYiCE MyXalytics

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

HCL DRYiCE MyXalytics is impacted by path traversal arbitrary file read vulnerability because it uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory.  The product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Potential exploits can completely disrupt or take over the application.

HCL DRYiCE MyXalytics se ve afectado por la vulnerabilidad de lectura de archivos arbitrarios de path traversal porque utiliza entrada externa para construir un nombre de ruta destinado a identificar un archivo o directorio que se encuentra debajo de un directorio principal restringido. El producto no neutraliza adecuadamente los elementos especiales dentro del nombre de ruta que pueden hacer que el nombre de ruta se resuelva en una ubicación que está fuera del directorio restringido. Las posibles explotaciones pueden interrumpir por completo la aplicación o apoderarse de ella.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-10-10 CVE Reserved
  • 2024-01-03 CVE Published
  • 2024-01-10 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Hcltech
Search vendor "Hcltech"
 Dryice Myxalytics
Search vendor "Hcltech" for product "Dryice Myxalytics"
 5.9
Search vendor "Hcltech" for product "Dryice Myxalytics" and version "5.9"
-
Affected
Hcltech
Search vendor "Hcltech"
 Dryice Myxalytics
Search vendor "Hcltech" for product "Dryice Myxalytics"
 6.0
Search vendor "Hcltech" for product "Dryice Myxalytics" and version "6.0"
-
Affected
Hcltech
Search vendor "Hcltech"
 Dryice Myxalytics
Search vendor "Hcltech" for product "Dryice Myxalytics"
 6.1
Search vendor "Hcltech" for product "Dryice Myxalytics" and version "6.1"
-
Affected