CVE-2024-23565

{"id": "CVE-2024-23565", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-23565", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-17T15:14:30.173827Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCLSoftware", "product": "Aftermarket EPC", "versions": [{"status": "affected", "version": "version 1.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-17T14:17:16.647", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294", "source": "psirt@hcl.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-799"}]}], "descriptions": [{"lang": "en", "value": "HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password functionality. The actor could b e a human or an automated process such as a virus or bot. This could be used to cause a denial of service, compromise program logic or other consequences."}, {"lang": "es", "value": "HCL Aftermarket EPC es vulnerable a la inundaci\u00f3n de correos electr\u00f3nicos ya que la aplicaci\u00f3n no cuenta con un mecanismo adecuado de limitaci\u00f3n de correo en la funcionalidad de 'Olvid\u00e9 mi contrase\u00f1a'. El actor podr\u00eda ser un humano o un proceso automatizado como un virus o un bot. Esto podr\u00eda usarse para causar una denegaci\u00f3n de servicio, comprometer la l\u00f3gica del programa u otras consecuencias."}], "lastModified": "2026-10-02T00:10:00.180", "sourceIdentifier": "psirt@hcl.com"}