CVE-2024-23577

Published: Jul 17, 2026Modified: Jul 17, 2026Deferred

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: psirt@hcl.com (Secondary)

Description

HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requested in http protocol. When an application doesn’t adequately validate or sanitize this header, it can lead to several security risks, including Host header poisoning, server misconfigurations.

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (1)

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294

Source: psirt@hcl.com

Timeline

No history available yet.