Login Request a demo
Medium severity · published Jul 17, 2026
CVE-2024-23567
HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during normal usage
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during normal usage. Data passed in this manner can be exposed because it may end up stored in unintended locations, including server logs, local browser history and proxy logs.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
Aftermarket EPC · HCLSoftware
version 1.0.0 · source: vendor
Affected product
AE
Aftermarket EPC
HCLSoftware
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-23567
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-23567
support.hcl-software.com
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294
More from Aftermarket EPC
6.5
CVE-2024-23566
HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented
5.3
CVE-2024-23574
HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to either guess or confirm valid users in the system
5.3
CVE-2024-42214
HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server
5.3
CVE-2024-23575
HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing on the server
5.3
CVE-2024-23568
HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by the web server