CVE-2024-23577
Possible ATT&CK Techniques 1AI
T1071 · Application Layer ProtocolAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| HCLSoftware | Aftermarket EPC | version 1.0.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-23577
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requested in http protocol. When an application doesn’t adequately validate or sanitize this header, it can lead to several security risks, including Host header poisoning, server misconfigurations.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
HCL Aftermarket EPC 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HCL Aftermarket EPC是印度HCL公司的一款售后服务与电子零件目录管理软件。 HCL Aftermarket EPC 1.0.0版本存在输入验证错误漏洞，该漏洞源于对HOST标头验证不足，接受任意主机，可能导致主机标头投毒和服务器配置错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HCLSoftware | Aftermarket EPC | version 1.0.0 | - |
II. Public POCs for CVE-2024-23577
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-23577
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-23577 (1)
Same Patch Batch · HCLSoftware · 2026-07-17 · 20 CVEs total
| CVE-2024-23566 | 6.5 MEDIUM | HCL Aftermarket EPC 授权问题漏洞 |
| CVE-2026-21770 | 6.5 MEDIUM | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to DLL hijacking |
| CVE-2024-42214 | 5.3 MEDIUM | HCL Aftermarket EPC 跨站脚本漏洞 |
| CVE-2024-23565 | 5.3 MEDIUM | HCL Aftermarket EPC 资源管理错误漏洞 |
| CVE-2024-23568 | 5.3 MEDIUM | HCL Aftermarket EPC 信息泄露漏洞 |
| CVE-2024-23574 | 5.3 MEDIUM | HCL Aftermarket EPC 侧信道信息泄露漏洞 |
| CVE-2024-23575 | 5.3 MEDIUM | HCL Aftermarket EPC 信息泄露漏洞 |
| CVE-2026-21760 | 4.6 MEDIUM | Unauthorized Access to Admin Functionality via Forced Browsing |
| CVE-2024-23567 | 4.3 MEDIUM | HCL Aftermarket EPC 授权问题漏洞 |
| CVE-2024-23570 | 4.3 MEDIUM | HCL Aftermarket EPC 信息泄露漏洞 |
| CVE-2024-23569 | 4.3 MEDIUM | HCL Aftermarket EPC 跨站脚本漏洞 |
| CVE-2024-23571 | 4.3 MEDIUM | HCL Aftermarket EPC 信息泄露漏洞 |
| CVE-2024-23578 | 4.2 MEDIUM | HCL Aftermarket EPC 配置错误漏洞 |
| CVE-2024-23572 | 4.2 MEDIUM | HCL Aftermarket EPC 会话机制问题漏洞 |
| CVE-2026-21761 | 4.2 MEDIUM | CORS Misconfiguration in DevOps Loop |
| CVE-2024-23573 | 3.7 LOW | HCL Aftermarket EPC 授权问题漏洞 |
| CVE-2026-21762 | 3.7 LOW | Missing HTTP Security Headers in DevOps Loop |
| CVE-2025-59866 | 3.3 LOW | HCLSoftware DFMPro for CATIA 权限许可和访问控制问题漏洞 |
| CVE-2026-21764 | 3.1 LOW | Insufficient Input Validation in DevOps Loop |
IV. Related Vulnerabilities
Same vendor: HCLSoftware
- CVE-2026-56583
HCL MyCloud was affected with Concurrent Login Vulnerability - CVE-2026-56582
HCL MyCloud was affected with SSL/TLS Protocol Affected with - CVE-2026-56581
HCL MyCloud was affected with Cookie Attribute Path Not Set - CVE-2026-56580
HCL MyCloud was affected by Using Components with Known Vuln - CVE-2026-56579
HCL MyCloud was affected with Exposure of Sensitive Informat
Same weakness: CWE-20
- CVE-2026-46452
Apache NimBLE: Mesh Proxy SAR reassembly unbounded append an - CVE-2026-54120
Microsoft Surface Remote Code Execution Vulnerability - CVE-2026-65604
Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass - CVE-2026-47668
DbGate: Unauthenticated Remote Code Execution via JSON Scrip - CVE-2026-16723
Remote Code Execution in fastjson 1.2.68–1.2.83
V. Comments for CVE-2024-23577
No comments yet