CVE-2024-42168 is a high severity (CVSS 8.9) vulnerability in HCL MyXalytics. An attacker can run a web server that returns malicious content and trick the application into retrieving and processing it. The record gives no fixed version, so read HCL's knowledge base article KB0118149 and apply the update it names.
What's affected
The NVD record names HCL MyXalytics as the affected product. It does not list version numbers or fixed versions.
HCL publishes the details in knowledge base article KB0118149. When I fetched that page, it rendered only a loading message, so I could not read the affected and fixed versions. Open the article in a browser with your HCL support login if needed, and take the version list from there.
The same HCL article covers several HCL MyXalytics CVEs published together, so one update pass may close more than one.
How to check if you're exposed
Find out whether you run HCL MyXalytics at all. Ask the team that owns collaboration, analytics or cloud tools, because these products are often installed by a business unit.
Then read the version from the product's about or admin page, and compare it with the affected and fixed versions in article KB0118149.
If the article is hard to reach, open a case with HCL support and ask for the fixed version in writing.
What to do now
- Read HCL article KB0118149 and write down the affected and fixed versions.
- Update to the fixed version the article names.
- Restrict outbound connections from the MyXalytics server to the hosts it needs.
- Review outbound request logs for connections to unfamiliar external hosts.
- Keep the application off the public internet if it does not need to be there.
Why it matters
The record lists CWE-610, externally controlled reference to a resource, and CWE-918, server-side request forgery. The application can be steered to fetch a URL that an outsider chose. What the server then does with the response is where the harm starts, because it processes the content.
The vector has a changed scope, which is why the score reaches 8.9 even though the attack complexity is high. A server that can reach internal systems and the internet can be used as a stepping stone. Egress filtering, so the application server can talk only to the hosts it needs, limits that.
A note on vendor articles. Some support portals load their content with scripts, so a plain page fetch or a text-only reader shows nothing. If you track advisories with an automated tool, check that it can read the articles you depend on, or you may miss the fixed version. Keep a record of the article number, the date you read it and the version you chose, so the audit trail is clear if someone asks later.
Quick check
What does out-of-band resource load mean here?
The application loads a resource from a location the attacker controls, then processes it, so the attacker's content reaches the server.
Sources
Last reviewed: 19 October 2026.
