CVE-2024-23564

HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redirect them to their own email address by manipulating the server's response. The application includes checks in the initial requests to verify the validity of the provided UserId, but similar validation is not applied to Email requests when sending passwords to user emails.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131787

Configurations

No configuration.

History

02 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) HCL Aftermarket EPC se ve afectado por una Vulnerabilidad de Lógica de Negocio mediante la cual un usuario no válido de la aplicación puede obtener contraseñas del servidor y redirigirlas a su propia dirección de correo electrónico manipulando la respuesta del servidor. La aplicación incluye comprobaciones en las solicitudes iniciales para verificar la validez del UserId proporcionado, pero una validación similar no se aplica a las solicitudes de correo electrónico al enviar contraseñas a los correos electrónicos de los usuarios.

Information

Published : 2026-07-17 14:17

Updated : 2026-10-02 00:10

NVD link : CVE-2024-23564

Mitre link : CVE-2024-23564

CVE.ORG link : CVE-2024-23564

JSON object : View

Products Affected

No product.

CWE

CWE-326

Inadequate Encryption Strength

{"id": "CVE-2024-23564", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-23564", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-17T13:54:35.346135Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCL Software", "product": "Aftermarket EPC", "versions": [{"status": "affected", "version": "version 1.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-17T14:17:16.513", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131787", "source": "psirt@hcl.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-326"}]}], "descriptions": [{"lang": "en", "value": "HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redirect them to their own email address by manipulating the server's response. The application includes checks in the initial requests to verify the validity of the provided UserId, but similar validation is not applied to Email requests when sending passwords to user emails."}, {"lang": "es", "value": "HCL Aftermarket EPC se ve afectado por una Vulnerabilidad de L\u00f3gica de Negocio mediante la cual un usuario no v\u00e1lido de la aplicaci\u00f3n puede obtener contrase\u00f1as del servidor y redirigirlas a su propia direcci\u00f3n de correo electr\u00f3nico manipulando la respuesta del servidor. La aplicaci\u00f3n incluye comprobaciones en las solicitudes iniciales para verificar la validez del UserId proporcionado, pero una validaci\u00f3n similar no se aplica a las solicitudes de correo electr\u00f3nico al enviar contrase\u00f1as a los correos electr\u00f3nicos de los usuarios."}], "lastModified": "2026-10-02T00:10:00.180", "sourceIdentifier": "psirt@hcl.com"}