Login Request a demo
Medium severity · published Jul 17, 2026
CVE-2024-23568
HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by the web server
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by the web server. Displaying version information of software could allow an attacker to determine which vulnerabilities are present in the software, particularly if an outdated software version is in use with published vulnerabilities.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
Aftermarket EPC · HCLSoftware
version 1.0.0 · source: vendor
Affected product
AE
Aftermarket EPC
HCLSoftware
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-23568
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-23568
support.hcl-software.com
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294
More from Aftermarket EPC
6.5
CVE-2024-23566
HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented
5.3
CVE-2024-23574
HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to either guess or confirm valid users in the system
5.3
CVE-2024-42214
HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server
5.3
CVE-2024-23575
HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing on the server
5.3
CVE-2024-23565
HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password functionality