Log in Start free

Vulnerability · Published Jul 17, 2026 · Assigned by HCL

CVE-2024-23564

Critical 9.1

In plain English

A critical-severity security flaw in Aftermarket EPC from HCL Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.3%top 77.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redirect them to their own email address by manipulating the server's response. The application includes checks in the initial requests to verify the validity of the provided UserId, but similar validation is not applied to Email requests when sending passwords to user emails.

Affected products (as reported)

VendorProductVersions
HCL Software Aftermarket EPC version 1.0.0

Weakness: CWE-326 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References