CVE-2024-23567
Quick assessment
Affected
HCLSoftware Aftermarket EPC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
HCL Aftermarket EPC是印度HCL公司的一款售后服务与电子零件目录管理软件。 HCL Aftermarket EPC 1.0.0版本存在授权问题漏洞，该漏洞源于在GET方法和URL中传递敏感数据，可能导致数据在正常使用过程中通过URL参数泄露，并存储在服务器日志、本地浏览器历史记录和代理日志等位置。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local SystemAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| HCLSoftware | Aftermarket EPC | version 1.0.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-23567
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during normal usage. Data passed in this manner can be exposed because it may end up stored in unintended locations, including server logs, local browser history and proxy logs.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
可猜测的验证码
Source: CVE Program / CVE List V5
Vulnerability Title
HCL Aftermarket EPC 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HCL Aftermarket EPC是印度HCL公司的一款售后服务与电子零件目录管理软件。 HCL Aftermarket EPC 1.0.0版本存在授权问题漏洞，该漏洞源于在GET方法和URL中传递敏感数据，可能导致数据在正常使用过程中通过URL参数泄露，并存储在服务器日志、本地浏览器历史记录和代理日志等位置。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HCLSoftware | Aftermarket EPC | version 1.0.0 | - |
|
II. Public POCs for CVE-2024-23567
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-23567
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-23567 (1)
Same Patch Batch · HCLSoftware · 2026-07-17 · 20 CVEs total
| CVE-2024-23566 | 6.5 MEDIUM | HCL Aftermarket EPC 授权问题漏洞 |
| CVE-2026-21770 | 6.5 MEDIUM | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to DLL hijacking |
| CVE-2024-42214 | 5.3 MEDIUM | HCL Aftermarket EPC 跨站脚本漏洞 |
| CVE-2024-23565 | 5.3 MEDIUM | HCL Aftermarket EPC 资源管理错误漏洞 |
| CVE-2024-23568 | 5.3 MEDIUM | HCL Aftermarket EPC 信息泄露漏洞 |
| CVE-2024-23574 | 5.3 MEDIUM | HCL Aftermarket EPC 侧信道信息泄露漏洞 |
| CVE-2024-23575 | 5.3 MEDIUM | HCL Aftermarket EPC 信息泄露漏洞 |
| CVE-2026-21760 | 4.6 MEDIUM | Unauthorized Access to Admin Functionality via Forced Browsing |
| CVE-2024-23570 | 4.3 MEDIUM | HCL Aftermarket EPC 信息泄露漏洞 |
| CVE-2024-23569 | 4.3 MEDIUM | HCL Aftermarket EPC 跨站脚本漏洞 |
| CVE-2024-23571 | 4.3 MEDIUM | HCL Aftermarket EPC 信息泄露漏洞 |
| CVE-2024-23577 | 4.3 MEDIUM | HCL Aftermarket EPC 输入验证错误漏洞 |
| CVE-2024-23578 | 4.2 MEDIUM | HCL Aftermarket EPC 配置错误漏洞 |
| CVE-2024-23572 | 4.2 MEDIUM | HCL Aftermarket EPC 会话机制问题漏洞 |
| CVE-2026-21761 | 4.2 MEDIUM | CORS Misconfiguration in DevOps Loop |
| CVE-2024-23573 | 3.7 LOW | HCL Aftermarket EPC 授权问题漏洞 |
| CVE-2026-21762 | 3.7 LOW | Missing HTTP Security Headers in DevOps Loop |
| CVE-2025-59866 | 3.3 LOW | HCLSoftware DFMPro for CATIA 权限许可和访问控制问题漏洞 |
| CVE-2026-21764 | 3.1 LOW | Insufficient Input Validation in DevOps Loop |
IV. Related Vulnerabilities
Same vendor: HCLSoftware
-
CVE-2026-67075
HCL Digital Experience is affected by improper input sanitat -
CVE-2026-67071
HCL DevOps Deploy / HCL Launch is susceptible to an Improper -
CVE-2026-21827
HCL Connections is vulnerable to an information disclosure v -
CVE-2025-62341
HCL Connections is vulnerable to server-side request forgery -
CVE-2026-21808
HCL BigFix Quantum Risk Analyzer is affected by logging sens
Same weakness: CWE-804
-
CVE-2024-23566
HCL Aftermarket EPC 授权问题漏洞 -
CVE-2026-49953
Discuz! X5.0 CAPTCHA Bypass via Predictable Character Set -
CVE-2026-40935
WWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Lengt -
CVE-2026-27411
WordPress SiteGuard WP plugin plugin <= 1.7.9 - Captcha Bypa -
CVE-2025-10423
newbee-mall kaptcha mallKaptcha Captcha
V. Comments for CVE-2024-23567
No comments yet