Medium severity · published Jul 17, 2026
CVE-2024-23571
HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifying the extent to which the page and its form fields should be…
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifying the extent to which the page and its form fields should be cached. If sensitive information in application responses is stored in the local cache, then this may be retrieved by other users who have access to the same computer at a future time.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
Aftermarket EPC · HCLSoftware
version 1.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-23571
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-23571
support.hcl-software.com
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294
More from Aftermarket EPC
6.5
CVE-2024-23566
HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented
5.3
CVE-2024-23574
HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to either guess or confirm valid users in the system
5.3
CVE-2024-42214
HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server
5.3
CVE-2024-23575
HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing on the server
5.3
CVE-2024-23568
HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by the web server