FKIE_CVE-2025-59870

Vulnerability from fkie_nvd - Published: 2026-01-16 11:16 - Updated: 2026-01-23 17:05
Severity ?
7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
HCL MyXalytics  is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk
References
psirt@hcl.comhttps://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128115Vendor Advisory
Impacted products
Vendor Product Version
hcltech myxalytics 6.2
hcltech myxalytics 6.3
hcltech myxalytics 6.4
hcltech myxalytics 6.5
hcltech myxalytics 6.6
hcltech myxalytics 6.7
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hcltech:myxalytics:6.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C6F2615-0B25-4465-BE38-714313C9062F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hcltech:myxalytics:6.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "79D5EDA2-6774-4B8A-A3AC-659FFC139B5F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hcltech:myxalytics:6.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "8533B38F-22F2-4D0E-8276-6B8F86D826C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hcltech:myxalytics:6.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "0774CC44-C753-433F-85C3-9934FEE6BC1F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hcltech:myxalytics:6.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "20B1E85F-A207-4692-A491-8DAE3D00654F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hcltech:myxalytics:6.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "2858C304-AFAB-4ECA-96F0-C90A97F7A2DC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "HCL MyXalytics\u00a0 is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk"
    },
    {
      "lang": "es",
      "value": "HCL MyXalytics se ve afectado por la gesti\u00f3n inadecuada de un secreto de firma JWT est\u00e1tico en la aplicaci\u00f3n web, donde el secreto carece de rotaci\u00f3n, introduciendo un riesgo de seguridad."
    }
  ],
  "id": "CVE-2025-59870",
  "lastModified": "2026-01-23T17:05:07.123",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.2,
        "source": "psirt@hcl.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-01-16T11:16:02.660",
  "references": [
    {
      "source": "psirt@hcl.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0128115"
    }
  ],
  "sourceIdentifier": "psirt@hcl.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-323"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.