CVE-2024-42172 is a medium severity (CVSS 5.3) vulnerability in HCL MyXalytics. Broken authentication can let attackers compromise keys, passwords and session tokens. The record gives no fixed version, so read HCL's knowledge base article KB0118149 and apply the update it names.
What's affected
The NVD record names HCL MyXalytics as the affected product. It does not list version numbers or fixed versions.
HCL publishes the details in knowledge base article KB0118149. When I fetched that page, it rendered only a loading message, so I could not read the affected and fixed versions. Open the article in a browser with your HCL support login if needed, and take the version list from there.
The same HCL article covers several HCL MyXalytics CVEs published together, so one update pass may close more than one.
How to check if you're exposed
Find out whether you run HCL MyXalytics at all. Ask the team that owns collaboration, analytics or cloud tools, because these products are often installed by a business unit.
Then read the version from the product's about or admin page, and compare it with the affected and fixed versions in article KB0118149.
If the article is hard to reach, open a case with HCL support and ask for the fixed version in writing.
What to do now
- Read HCL article KB0118149 and write down the affected and fixed versions.
- Update to the fixed version the article names.
- After the update, rotate passwords, API keys and secrets that MyXalytics stores or uses.
- Invalidate existing sessions so previously issued tokens stop working.
- Require multi-factor authentication in front of the application where possible.
Why it matters
The record lists CWE-287, improper authentication, and CWE-522, insufficiently protected credentials. The description is generic. It says the cause may be poor configuration, logic errors or software bugs, and it does not say which applies to this product.
Because the detail is thin, the safe response is to follow HCL's fix and to assume that secrets handled by the application could be exposed. After updating, rotate the passwords and keys the application stores or uses, and end existing sessions so that old tokens stop working.
A note on vendor articles. Some support portals load their content with scripts, so a plain page fetch or a text-only reader shows nothing. If you track advisories with an automated tool, check that it can read the articles you depend on, or you may miss the fixed version. Keep a record of the article number, the date you read it and the version you chose, so the audit trail is clear if someone asks later.
Quick check
The description is generic. Is there a specific bug?
The NVD text does not name one. HCL's article is the reference, and it needs a browser to read.
Sources
Last reviewed: 19 October 2026.
