CVE-2024-23564
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| HCL Software | Aftermarket EPC | version 1.0.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-23564
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redirect them to their own email address by manipulating the server's response. The application includes checks in the initial requests to verify the validity of the provided UserId, but similar validation is not applied to Email requests when sending passwords to user emails.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的加密强度
Source: CVE Program / CVE List V5
Vulnerability Title
HCL Aftermarket EPC 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HCL Aftermarket EPC是印度HCL公司的一款售后服务与电子零件目录管理软件。 HCL Aftermarket EPC 1.0.0版本存在加密问题漏洞，该漏洞源于业务逻辑问题，非有效用户可通过操作服务器响应获取密码并将其重定向到自己的电子邮件地址。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HCL Software | Aftermarket EPC | version 1.0.0 | - |
II. Public POCs for CVE-2024-23564
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-23564
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-23564 (1)
IV. Related Vulnerabilities
Same vendor: HCL Software
- CVE-2026-21832
HCL AION is affected by multiple security vulnerabilities. - CVE-2025-62315
HCL AION is affected by multiple security vulnerabilities. - CVE-2025-62318
HCL AION is affected by multiple security vulnerabilities. - CVE-2025-62314
HCL AION is affected by multiple security vulnerabilities. - CVE-2025-52640
HCL AION is affected by multiple security vulnerabilities.
Same weakness: CWE-326
- CVE-2026-74889
openssl_encrypt before 1.4.0 Weak Key Derivation via HKDF - CVE-2026-65777
Active Directory Security Feature Bypass Vulnerability - CVE-2026-9201
Langflow OSS is affected by arbitrary code execution in comp - CVE-2026-59651
BKS keystore accepts legacy version with 16-bit integrity MA - CVE-2026-4648
Insufficient Encryption Level in CasfID Servicios Tecnológic
V. Comments for CVE-2024-23564
No comments yet