CVE-2024-42181
Published: 12 January 2025
Summary
CVE-2024-42181 is a low-severity Cleartext Transmission of Sensitive Information (CWE-319) vulnerability in Hcltech Dryice Myxalytics. Its CVSS base score is 1.6 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 33.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-13 (Cryptographic Protection) and SC-8 (Transmission Confidentiality and Integrity).
Deeper analysis
CVE-2024-42181 is a cleartext transmission of sensitive information vulnerability (CWE-319) affecting HCL MyXalytics. The application transmits sensitive or security-critical data in cleartext over a communication channel that can be sniffed by unauthorized actors. This issue was published on 2025-01-12 and carries a CVSS v3.1 base score of 1.6 (AV:P/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N), indicating low severity due to its restrictive requirements.
Exploitation requires physical access (AV:P) to the system, high attack complexity (AC:H), and high privileges (PR:H), with no user interaction needed (UI:N). Successful attackers can achieve low-impact confidentiality disclosure (C:L), such as sniffing sensitive data transmitted in cleartext, but with no impact on integrity or availability and unchanged scope (S:U).
The HCL support knowledge base article at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118149 provides further details on this vulnerability, including potential mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-40004
Vulnerability details
HCL MyXalytics is affected by a cleartext transmission of sensitive information vulnerability. The application transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Cleartext transmission (CWE-319) directly enables network sniffing to capture sensitive data in transit.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-8 requires protecting the confidentiality of transmitted information, directly preventing sniffing of cleartext sensitive data in the communication channel.
SC-13 mandates cryptographic mechanisms to prevent unauthorized disclosure of information during transmission, comprehensively addressing the cleartext vulnerability.
PE-4 controls physical access to transmission media, mitigating the physical access vector required to sniff the cleartext communications.