CVE-2024-30150 is a medium severity (CVSS 5.3) vulnerability in HCL MyCloud. Improper access control lets an unauthenticated user escalate privilege, which can lead to information disclosure, server-side request forgery and denial of service. The record gives no fixed version, so read HCL's knowledge base article KB0119368 and apply the update it names.
What's affected
The NVD record names HCL MyCloud as the affected product. It does not list version numbers or fixed versions.
HCL publishes the details in knowledge base article KB0119368. When I fetched that page, it rendered only a loading message, so I could not read the affected and fixed versions. Open the article in a browser with your HCL support login if needed, and take the version list from there.
How to check if you're exposed
Find out whether you run HCL MyCloud at all. Ask the team that owns collaboration, analytics or cloud tools, because these products are often installed by a business unit.
Then read the version from the product's about or admin page, and compare it with the affected and fixed versions in article KB0119368.
If the article is hard to reach, open a case with HCL support and ask for the fixed version in writing.
What to do now
- Read HCL article KB0119368 and write down the affected and fixed versions.
- Update to the fixed version the article names.
- Limit network access to the MyCloud service to the networks and users that need it.
- Review logs for unauthenticated requests to administrative or internal paths, and for outbound requests to unexpected internal addresses.
- Block the service from reaching cloud metadata endpoints and sensitive internal ranges where your network allows it.
Why it matters
The record lists two classes: CWE-269, improper privilege management, and CWE-918, server-side request forgery. The first means a caller who should have no rights can act with more. The second means the server can be made to send requests on the attacker's behalf, often to internal addresses the attacker cannot reach.
The score is medium because the stated impact is low and limited to confidentiality. Still, an unauthenticated route is worth closing quickly, since anyone who can reach the service can try it. Restrict access to the service to the networks that need it while you update.
A note on vendor articles. Some support portals load their content with scripts, so a plain page fetch or a text-only reader shows nothing. If you track advisories with an automated tool, check that it can read the articles you depend on, or you may miss the fixed version. Keep a record of the article number, the date you read it and the version you chose, so the audit trail is clear if someone asks later.
Quick check
What is server-side request forgery?
A flaw that makes a server send requests to places chosen by an attacker, often internal systems that are not reachable from outside.
Sources
Last reviewed: 19 October 2026.
