« Volver al listado

CVE-2025-59870

Estado: AnalizadaCrítica (9.8)—

HCL MyXalytics  is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS de red sin autenticación (AV:N/PR:N/UI:N) con impacto total de confidencialidad, integridad y disponibilidad. JWT estático sin rotación permite autenticación falsa (T1078.001), ejecución de código (T1059) y acceso a datos (T1005).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementVulnerability ScanningRestrict Web-Based ContentPassword PoliciesNetwork SegmentationMulti-factor Authentication

Tecnologías afectadas (1)

Hcltech — Myxalytics

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-59870",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-59870",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-16T12:12:28.762228Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@hcl.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.4,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@hcl.com",
      "affectedData": [
        {
          "vendor": "HCL Software",
          "product": "MyXalytics",
          "versions": [
            {
              "status": "affected",
              "version": "6.2",
              "lessThan": "6.7",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-01-16T11:16:02.660",
  "references": [
    {
      "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128115",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@hcl.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-323"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "HCL MyXalytics  is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk"
    },
    {
      "lang": "es",
      "value": "HCL MyXalytics se ve afectado por la gestión inadecuada de un secreto de firma JWT estático en la aplicación web, donde el secreto carece de rotación, introduciendo un riesgo de seguridad."
    }
  ],
  "lastModified": "2026-06-17T09:46:49.440",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hcltech:myxalytics:6.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C6F2615-0B25-4465-BE38-714313C9062F"
            },
            {
              "criteria": "cpe:2.3:a:hcltech:myxalytics:6.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79D5EDA2-6774-4B8A-A3AC-659FFC139B5F"
            },
            {
              "criteria": "cpe:2.3:a:hcltech:myxalytics:6.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8533B38F-22F2-4D0E-8276-6B8F86D826C4"
            },
            {
              "criteria": "cpe:2.3:a:hcltech:myxalytics:6.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0774CC44-C753-433F-85C3-9934FEE6BC1F"
            },
            {
              "criteria": "cpe:2.3:a:hcltech:myxalytics:6.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "20B1E85F-A207-4692-A491-8DAE3D00654F"
            },
            {
              "criteria": "cpe:2.3:a:hcltech:myxalytics:6.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2858C304-AFAB-4ECA-96F0-C90A97F7A2DC"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@hcl.com"
}