CVE-2024-23566

MediumCVSS 6.5/10Last modified Oct 2, 2026

Description

HCL Aftermarket EPC is vulnerable to brute force attacks since application doesn’t have captcha implemented. It can lead to various security issues like brute force , automated attacks & account enumeration

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-804

Affected software

No affected versions have been published.

Timeline

Published
Jul 17, 2026
Last modified
Oct 2, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-235674.3HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL paraCVE-2024-235685.3HCL Aftermarket EPC is vulnerable to attacks since the server software version used by the application is revealed by the web server. DisplaCVE-2024-235694.3HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" headerCVE-2024-23576.5The Libreswan Project was notified of an issue causing libreswan to restart under some IKEv2 retransmit scenarios when a connection is confiCVE-2024-235704.3HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack technique where an attacker loads a vulneraCVE-2024-235714.3HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifying the extent to whichCVE-2024-235724.2HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk associated with this iCVE-2024-235733.7HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that makes the SS LLUCKY13 possible affects theCVE-2024-235745.3HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to either guess or confCVE-2024-235755.3HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processingCVE-2024-235767.1Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of CVE-2024-235774.3HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requeste
CVE-2024-23566: Medium severity, CVSS 6.5 | Vulnix