CVE-2024-23578
Received Received - Intake

HCL Aftermarket EPC Misconfigured CORS Policy

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: HCL Software

Description
HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS) policy for this request that allows access from any domain (*-Wildcard).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-17
Last Modified
2026-07-17
Generated
2026-07-17
AI Q&A
2026-07-17
EPSS Evaluated
N/A
NVD
CVE-2024-23578
EUVD
EUVD-2024-55670

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hcl aftermarket_epc *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-942 The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

HCL Aftermarket EPC has a vulnerability due to an overly permissive HTML5 CORS policy. This allows any external domain to make cross-origin requests to the application, potentially exposing sensitive data or enabling unauthorized actions.

Detection Guidance

This vulnerability involves a wildcard CORS policy in HCL Aftermarket EPC. Detection requires checking HTTP response headers for 'Access-Control-Allow-Origin: *' in responses from the application. Use curl commands like 'curl -I http://target-server' to inspect headers. Browser developer tools can also reveal CORS misconfigurations during normal traffic analysis.

Impact Analysis

An attacker could exploit this to access restricted resources, steal data, or perform actions on behalf of users. The impact includes data breaches, unauthorized access, or manipulation of application behavior.

Compliance Impact

This vulnerability may violate GDPR and HIPAA by exposing personal or sensitive data to unauthorized parties. Compliance requires strict access controls, which this CORS misconfiguration undermines.

Mitigation Strategies

Implement a strict CORS policy by restricting allowed domains to only trusted sources instead of using a wildcard (*). Review and update the application's CORS configuration to prevent unauthorized cross-origin access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-23578. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart