CVE-2024-30150: Privilege Escalation in HCL MyCloud

The Improper Access Control vulnerability in HCL MyCloud allows unauthenticated attackers to bypass security controls and gain elevated privileges. This can manifest in several ways. An attacker could potentially read sensitive configuration files or user data, leading to information disclosure. Furthermore, the vulnerability opens the door to SSRF attacks, where the attacker can trick the server into making requests to internal or external resources, potentially exposing internal services or data. Finally, the attacker could launch a DoS attack, disrupting the availability of the MyCloud service. The lack of authentication required to exploit this vulnerability significantly broadens the attack surface.

1. Reserved2024-03-22
2. Published2025-02-25
3. Modified2025-02-26
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-30150 is to upgrade HCL MyCloud to version 10.8.2 or later, which contains the fix for the Improper Access Control vulnerability. If an immediate upgrade is not feasible, consider implementing temporary workarounds. Restrict network access to the MyCloud service using a Web Application Firewall (WAF) or proxy to block suspicious requests. Review and tighten access control policies to minimize the potential impact of a successful exploit. Monitor system logs for unusual activity, particularly requests originating from unauthenticated users.