CVE-2024-30150 An unauthenticated privilege escalation vulnerability affects HCL MyCloud
Unauthenticated attackers can escalate privileges, disclose information, and cause denial of service in HCL MyCloud.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-30150?
CVE-2024-30150 is a medium-severity vulnerability in HCL Software MyCloud, published on 25 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HCL MyCloud is affected by Improper Access Control - an unauthenticated privilege escalation vulnerability which may lead to information disclosure and potential for Server-Side Request Forgery (SSRF) and Denial of Service(DOS) attacks from unauthenticated users.
Which versions are affected by CVE-2024-30150?
It affects 1 product.
Products include Hcltech Dryice Mycloud.
How do I fix CVE-2024-30150?
No fix has been published for CVE-2024-30150 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-30150 being exploited?
There is no known exploitation of CVE-2024-30150 in the wild and no public exploit code.
Other vulnerabilities in HCL Software MyCloud
- CVE-2023-23346 Use of a broken cryptographic algorithm affects HCL DRYiCE MyCloud
- CVE-2026-56577 HCL MyCloud affected by Weak Password Policy
- CVE-2026-56579 HCL MyCloud was affected with Exposure of Sensitive Information to an Unauthorized Actor.
- CVE-2026-56582 HCL MyCloud was affected with SSL/TLS Protocol Affected with LUCKY13 Vulnerability.
- CVE-2026-56583 HCL MyCloud was affected with Concurrent Login Vulnerability.
Sources
Also known as GHSA-rpm8-r6fr-56f4.