CVE-2024-23577
Received Received - Intake

HOST Header Injection in HCL Aftermarket EPC

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: HCL Software

Description
HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requested in http protocol. When an application doesn’t adequately validate or sanitize this header, it can lead to several security risks, including Host header poisoning, server misconfigurations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-17
Last Modified
2026-07-17
Generated
2026-07-17
AI Q&A
2026-07-17
EPSS Evaluated
N/A
NVD
CVE-2024-23577
EUVD
EUVD-2024-55668

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hcl aftermarket_epc *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

HCL Aftermarket EPC is vulnerable because it does not validate the HOST header in HTTP requests. This allows attackers to send requests with arbitrary host values, which can lead to Host header poisoning and server misconfigurations.

Impact Analysis

This vulnerability could allow attackers to manipulate server behavior, redirect users to malicious sites, or bypass security controls. It may also lead to cache poisoning or other attacks exploiting improper host header handling.

Mitigation Strategies

Implement input validation for the HOST header in the application to ensure only expected values are accepted. Configure the web server to restrict or sanitize HOST header values. Update the application to reject requests with unexpected or arbitrary HOST headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-23577. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart