High severity · published May 14, 2024
CVE-2024-23576
Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations
7.1
CVSS
0.5%
EPSS
No
On KEV
Description
Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HC
Hcl Commerce · Hcltechsw
9.1.12 before 9.1.14 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-23576
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-23576
Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0112907
More from Hcl Commerce
9.8
CVE-2022-38656
HCL Commerce, when using Elasticsearch, can allow a remote attacker to cause a denial of service attack on the site and make administrative changes
9.8
CVE-2020-14275
Security vulnerability in HCL Commerce 9.0.0.5 through 9.0.0.13, 9.0.1.0 through 9.0.1.14 and 9.1 through 9.1.4 could allow denial of service, disclosure of user personal data,…
9.1
CVE-2021-27741
" Security vulnerability in HCL Commerce Management Center allowing XML external entity (XXE) injection"
7.5
CVE-2020-14274
Information disclosure vulnerability in HCL Commerce 9.0.1.9 through 9.0.1.14 and 9.1 through 9.1.4 could allow a remote attacker to obtain user personal data via unknown vectors
5.0
CVE-2021-27785
HCL Commerce could allow a local attacker to obtain sensitive personal information (CVE-2021-27785)