CVE-2023-45724 is a high severity unrestricted file upload flaw in HCL DRYiCE MyXalytics, scored 8.2. The web application accepts a certain upload without requiring authentication. Versions 5.9, 6.0 and 6.1 are listed. Apply HCL's fix from bulletin KB0109608. No login is needed, so reduce who can reach the service first.
What's affected
The NVD record lists HCL DRYiCE MyXalytics versions 5.9, 6.0 and 6.1 as affected. HCL's security bulletin, KB0109608, is the vendor source for fixes, but its content is loaded dynamically and I could not read the fix details from it. I will not guess a fixed version, so open the bulletin to confirm what HCL says to install.
Three CVEs in this range come from the same bulletin: CVE-2023-45722 (path traversal file read), CVE-2023-45723 (path traversal in file upload) and CVE-2023-45724 (unauthenticated file upload). The record dates are 3 January 2024.
How to check if you're exposed
In the MyXalytics administration pages or install directory, find the product version and compare it with 5.9, 6.0 and 6.1. Your HCL support contact or installation record also holds this.
Then check whether the application is reachable beyond the networks that need it. These flaws are in the web application, so exposure follows from who can reach its HTTP port. Review reverse proxy and firewall rules, and look in web server logs for requests to the affected endpoints with unusual paths.
What to do now
- Confirm the MyXalytics version against 5.9, 6.0 and 6.1.
- Apply the remedy in HCL bulletin KB0109608 as a priority, since no login is needed.
- Take the application off the internet until it is fixed, or limit access with a firewall or VPN.
- Search web server logs for upload requests from unfamiliar addresses.
- Inspect upload directories for files you cannot explain.
Why it matters
The weakness is unrestricted upload of a file with a dangerous type, CWE-434. What raises the urgency here is that the record says no user authentication is required. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N: reachable from the network, no privileges, no user action.
That makes this the first of the three to patch if you have to choose. Anyone who can reach the application can attempt the upload, so exposure depends mainly on how widely the service is reachable.
The CVE is not on the CISA KEV list, and I found no report of exploitation in the sources I could read. Unauthenticated flaws tend to be scanned for quickly once public, so reduce reachability now and apply the vendor fix.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads the manifests and lockfiles of software projects. It will not see firmware or device images, so for this issue the asset inventory and the vendor advisory are your main tools.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this need a login?
No. The record says the upload is permitted without user authentication.
What should I do first?
Limit who can reach the application, then apply the fix from HCL bulletin KB0109608.
Sources
- HCL security bulletin KB0109608 (content loads dynamically, so confirm fix details there)
- NVD record data for CVE-2023-45724
Last reviewed: 19 October 2026.
