CVE-2024-42175 is a low severity (CVSS 2.6) vulnerability in HCL MyXalytics. The application accepts special characters and has no length validation, which can open the way to SQL injection, cross-site scripting and buffer overflow. The record gives no fixed version, so read HCL's knowledge base article KB0118149 and apply the update it names.
What's affected
The NVD record names HCL MyXalytics as the affected product. It does not list version numbers or fixed versions.
HCL publishes the details in knowledge base article KB0118149. When I fetched that page, it rendered only a loading message, so I could not read the affected and fixed versions. Open the article in a browser with your HCL support login if needed, and take the version list from there.
The same HCL article covers several HCL MyXalytics CVEs published together, so one update pass may close more than one.
How to check if you're exposed
Find out whether you run HCL MyXalytics at all. Ask the team that owns collaboration, analytics or cloud tools, because these products are often installed by a business unit.
Then read the version from the product's about or admin page, and compare it with the affected and fixed versions in article KB0118149.
If the article is hard to reach, open a case with HCL support and ask for the fixed version in writing.
What to do now
- Read HCL article KB0118149 and write down the affected and fixed versions.
- Update to the fixed version the article names.
- Apply the update with the other MyXalytics fixes in the same article.
- Validate input length and character sets at the server, not only in the browser.
- Review the application for places where user input reaches a query or a page.
Why it matters
The class is CWE-20, improper input validation. This is the root of many bigger flaws. If an application does not check what it receives, other bugs downstream can turn that input into a query, a script or an overflow.
The score is low at 2.6 because the vector needs an authenticated user, user interaction and high attack complexity, and the stated impact is small. The advisory names SQL injection, XSS and buffer overflow as possible outcomes, but does not claim any of them was shown here. Apply the fix with the rest of the batch, and treat input checks as a standing review item for the application.
A note on vendor articles. Some support portals load their content with scripts, so a plain page fetch or a text-only reader shows nothing. If you track advisories with an automated tool, check that it can read the articles you depend on, or you may miss the fixed version. Keep a record of the article number, the date you read it and the version you chose, so the audit trail is clear if someone asks later.
Quick check
Why patch a low severity issue?
It ships in the same article as the other MyXalytics fixes, so applying the update costs little extra effort.
Sources
Last reviewed: 19 October 2026.
