CVE-2024-23560

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

HCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom security resource type.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-281

Affected software

No affected versions have been published.

Timeline

Published
Apr 15, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-235614.3HCL DevOps Deploy / HCL Launch is vulnerable to sensitive information disclosure vulnerability due to insufficient obfuscation of sensitive CVE-2024-235627.5A security vulnerability in HCL Domino could allow disclosure of sensitive configuration information. A remote unauthenticated attacker couCVE-2024-235634.4HCL Connections Docs is vulnerable to a sensitive information disclosure which could allow a user to obtain sensitive information they are nCVE-2024-235649.1HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from thCVE-2024-235655.3HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password fCVE-2024-235666.5HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented. It can lead to various securityCVE-2024-235674.3HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL paraCVE-2024-235685.3HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by the web server. DisplaCVE-2024-235694.3HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" headerCVE-2024-23576.5The Libreswan Project was notified of an issue causing libreswan to restart under some IKEv2 retransmit scenarios when a connection is confiCVE-2024-235704.3HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack technique where an attacker loads a vulneraCVE-2024-235714.3HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifying the extent to which
CVE-2024-23560: Medium severity, CVSS 4.9 | Vulnix