CVE-2024-23577

{"id": "CVE-2024-23577", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-23577", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-17T15:21:09.649438Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCLSoftware", "product": "Aftermarket EPC", "versions": [{"status": "affected", "version": "version 1.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-17T14:17:17.947", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294", "source": "psirt@hcl.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requested in http protocol. When an application doesn\u2019t adequately validate or sanitize this header, it can lead to several security risks, including Host header poisoning, server misconfigurations."}, {"lang": "es", "value": "HCL Aftermarket EPC es vulnerable ya que la aplicaci\u00f3n no tiene una validaci\u00f3n para el encabezado HOST y acepta hosts arbitrarios cuando se solicita en el protocolo HTTP. Cuando una aplicaci\u00f3n no valida o sanea adecuadamente este encabezado, puede dar lugar a varios riesgos de seguridad, incluyendo el envenenamiento del encabezado Host y configuraciones err\u00f3neas del servidor."}], "lastModified": "2026-10-02T00:10:00.180", "sourceIdentifier": "psirt@hcl.com"}