CVE-2024-23567
Received Received - Intake

Sensitive Information Exposure in HCL Aftermarket EPC

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: HCL Software

Description
HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during normal usage. Data passed in this manner can be exposed because it may end up stored in unintended locations, including server logs, local browser history and proxy logs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-17
Last Modified
2026-07-17
Generated
2026-07-17
AI Q&A
2026-07-17
EPSS Evaluated
N/A
NVD
CVE-2024-23567
EUVD
EUVD-2024-55659

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hcl aftermarket_epc *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-804 The product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

HCL Aftermarket EPC passes sensitive data via URL parameters in GET requests. This exposes the data in server logs, browser history, and proxy logs, increasing the risk of unauthorized access.

Detection Guidance

To detect this vulnerability, inspect network traffic for GET requests containing sensitive data in URLs. Check server logs, browser history, and proxy logs for exposed parameters. Use tools like Wireshark to capture and analyze HTTP traffic for URLs with sensitive information.

Impact Analysis

Attackers could intercept or access sensitive data stored in logs or browser history. This may lead to data breaches, privacy violations, or unauthorized actions if credentials or session tokens are exposed.

Compliance Impact

This vulnerability may violate GDPR and HIPAA by exposing sensitive personal or health data. Non-compliance could result in legal penalties, fines, or reputational damage due to unauthorized data exposure.

Mitigation Strategies

Disable passing sensitive data via GET methods or URL parameters in HCL Aftermarket EPC. Use POST methods instead and ensure sensitive information is not logged in server logs, browser history, or proxy logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-23567. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart