Executive brief
HCL MyCloud, a cloud management platform, is affected by a cryptographic vulnerability that could allow an attacker to decrypt secure communications. By exploiting a weakness in how the system handles encrypted data, an attacker could potentially intercept and read sensitive information. This could lead to the exposure of private data or credentials transmitted through the platform.
Technical details
HCL MyCloud version 10.8.2 is vulnerable to the LUCKY13 timing attack (CWE-327). This vulnerability exists in the implementation of the TLS protocol when using Cipher Block Chaining (CBC) mode padding. A remote attacker with network access and the ability to perform high-precision timing measurements can act as a padding oracle. By observing small differences in the time taken to process different padding patterns, the attacker can incrementally decrypt sensitive information from the TLS session. This attack requires a high level of complexity and authenticated access (PR:L) to execute successfully.
Affected products
- HCL Software MyCloud 10.8.2
Timeline
- 2026-07-21: advisory: HCL Software published the security bulletin and the CVE was recorded in NVD.