CVE-2024-23567
Possible ATT&CK Techniques 1AI
T1005 · Data from Local SystemAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| HCLSoftware | Aftermarket EPC | version 1.0.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-23567
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during normal usage. Data passed in this manner can be exposed because it may end up stored in unintended locations, including server logs, local browser history and proxy logs.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
可猜测的验证码
Source: NVD (National Vulnerability Database)
Vulnerability Title
HCL Aftermarket EPC 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HCL Aftermarket EPC是印度HCL公司的一款售后服务与电子零件目录管理软件。 HCL Aftermarket EPC 1.0.0版本存在授权问题漏洞，该漏洞源于在GET方法和URL中传递敏感数据，可能导致数据在正常使用过程中通过URL参数泄露，并存储在服务器日志、本地浏览器历史记录和代理日志等位置。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HCLSoftware | Aftermarket EPC | version 1.0.0 | - |
II. Public POCs for CVE-2024-23567
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-23567
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-23567 (1)
Same Patch Batch · HCLSoftware · 2026-07-17 · 20 CVEs total
| CVE-2024-23566 | 6.5 MEDIUM | HCL Aftermarket EPC 授权问题漏洞 |
| CVE-2026-21770 | 6.5 MEDIUM | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to DLL hijacking |
| CVE-2024-42214 | 5.3 MEDIUM | HCL Aftermarket EPC 跨站脚本漏洞 |
| CVE-2024-23565 | 5.3 MEDIUM | HCL Aftermarket EPC 资源管理错误漏洞 |
| CVE-2024-23568 | 5.3 MEDIUM | HCL Aftermarket EPC 信息泄露漏洞 |
| CVE-2024-23574 | 5.3 MEDIUM | HCL Aftermarket EPC 侧信道信息泄露漏洞 |
| CVE-2024-23575 | 5.3 MEDIUM | HCL Aftermarket EPC 信息泄露漏洞 |
| CVE-2026-21760 | 4.6 MEDIUM | Unauthorized Access to Admin Functionality via Forced Browsing |
| CVE-2024-23570 | 4.3 MEDIUM | HCL Aftermarket EPC 信息泄露漏洞 |
| CVE-2024-23569 | 4.3 MEDIUM | HCL Aftermarket EPC 跨站脚本漏洞 |
| CVE-2024-23571 | 4.3 MEDIUM | HCL Aftermarket EPC 信息泄露漏洞 |
| CVE-2024-23577 | 4.3 MEDIUM | HCL Aftermarket EPC 输入验证错误漏洞 |
| CVE-2024-23578 | 4.2 MEDIUM | HCL Aftermarket EPC 配置错误漏洞 |
| CVE-2024-23572 | 4.2 MEDIUM | HCL Aftermarket EPC 会话机制问题漏洞 |
| CVE-2026-21761 | 4.2 MEDIUM | CORS Misconfiguration in DevOps Loop |
| CVE-2024-23573 | 3.7 LOW | HCL Aftermarket EPC 授权问题漏洞 |
| CVE-2026-21762 | 3.7 LOW | Missing HTTP Security Headers in DevOps Loop |
| CVE-2025-59866 | 3.3 LOW | HCLSoftware DFMPro for CATIA 权限许可和访问控制问题漏洞 |
| CVE-2026-21764 | 3.1 LOW | Insufficient Input Validation in DevOps Loop |
IV. Related Vulnerabilities
Same vendor: HCLSoftware
- CVE-2026-56583
HCL MyCloud was affected with Concurrent Login Vulnerability - CVE-2026-56582
HCL MyCloud was affected with SSL/TLS Protocol Affected with - CVE-2026-56581
HCL MyCloud was affected with Cookie Attribute Path Not Set - CVE-2026-56580
HCL MyCloud was affected by Using Components with Known Vuln - CVE-2026-56579
HCL MyCloud was affected with Exposure of Sensitive Informat
Same weakness: CWE-804
- CVE-2024-23566
HCL Aftermarket EPC 授权问题漏洞 - CVE-2026-49953
Discuz! X5.0 CAPTCHA Bypass via Predictable Character Set - CVE-2026-40935
WWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Lengt - CVE-2026-27411
WordPress SiteGuard WP plugin plugin <= 1.7.9 - Captcha Bypa - CVE-2025-10423
newbee-mall kaptcha mallKaptcha Captcha
V. Comments for CVE-2024-23567
No comments yet