CVE-2023-45722 is a high severity path traversal flaw in HCL DRYiCE MyXalytics, scored 8.8. It lets an authenticated user read files outside the intended directory. Versions 5.9, 6.0 and 6.1 are listed. Apply the fix named in HCL bulletin KB0109608.
What's affected
The NVD record lists HCL DRYiCE MyXalytics versions 5.9, 6.0 and 6.1 as affected. HCL's security bulletin, KB0109608, is the vendor source for fixes, but its content is loaded dynamically and I could not read the fix details from it. I will not guess a fixed version, so open the bulletin to confirm what HCL says to install.
Three CVEs in this range come from the same bulletin: CVE-2023-45722 (path traversal file read), CVE-2023-45723 (path traversal in file upload) and CVE-2023-45724 (unauthenticated file upload). The record dates are 3 January 2024.
How to check if you're exposed
In the MyXalytics administration pages or install directory, find the product version and compare it with 5.9, 6.0 and 6.1. Your HCL support contact or installation record also holds this.
Then check whether the application is reachable beyond the networks that need it. These flaws are in the web application, so exposure follows from who can reach its HTTP port. Review reverse proxy and firewall rules, and look in web server logs for requests to the affected endpoints with unusual paths.
What to do now
- Confirm the MyXalytics version in use against 5.9, 6.0 and 6.1.
- Open HCL bulletin KB0109608 and apply the remedy it names.
- Restrict network access to the application to the users who need it.
- Review web logs for requests containing directory traversal patterns.
- Rotate secrets that sit on the same host if you find signs of file reads.
Why it matters
The weakness is path traversal, CWE-22. The application builds a file path from external input without neutralizing special elements, so a path can resolve outside the directory the application meant to restrict. The record's description says potential exploits can completely disrupt or take over the application.
The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: network reachable, low complexity, and a low privileged account. Reading files outside the web root can expose configuration, credentials and keys, which is how a read flaw turns into a takeover.
The CVE is not on the CISA KEV list, and the sources I could read do not report exploitation.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads the manifests and lockfiles of software projects. It will not see firmware or device images, so for this issue the asset inventory and the vendor advisory are your main tools.
Quick check
Which versions are affected?
The NVD record lists 5.9, 6.0 and 6.1. Confirm in HCL's bulletin.
What is the fixed version?
I could not read it from the bulletin. Check KB0109608 directly.
Sources
- HCL security bulletin KB0109608 (content loads dynamically, so confirm fix details there)
- NVD record data for CVE-2023-45722
Last reviewed: 19 October 2026.
