CVE-2024-23577

MediumCVSS 4.3/10Last modified Oct 2, 2026

Description

HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requested in http protocol. When an application doesn’t adequately validate or sanitize this header, it can lead to several security risks, including Host header poisoning, server misconfigurations.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
HCLSoftwareAftermarket EPCversion 1.0.0

References

Timeline

Published
Jul 17, 2026
Last modified
Oct 2, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-235784.2HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS) policy for this requCVE-2024-235796.5HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions. This could allow an attacker with access to the dCVE-2024-23589.8A path traversal vulnerability in the '/apply_settings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vuCVE-2024-235806.5HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs). This could allow an attacker with access tCVE-2024-235817.8The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized application.CVE-2024-235836.7An attacker could potentially intercept credentials via the task manager and perform unauthorized access to the Client Deploy Tool on WindowCVE-2024-235846.6The NMAP Importer service​ may expose data store credentials to authorized users of the Windows Registry.CVE-2024-235867.5HCL Nomad is susceptible to an insufficient session expiration vulnerability.   Under certain circumstances, an unauthenticated attacker couCVE-2024-235886.5HCL Nomad server on Domino fails to properly handle users configured with limited Domino access resulting in a possible denial of service vuCVE-2024-235896.8Due to outdated Hash algorithm, HCL Glovius Cloud could allow attackers to guess the input data using brute-force or dictionary attacks effiCVE-2024-23599.8A vulnerability in the parisneo/lollms-webui version 9.3 allows attackers to bypass intended access restrictions and execute arbitrary code.CVE-2024-235909.1Session Fixation vulnerability in Apache Kylin. This issue affects Apache Kylin: from 2.0.0 through 4.x. Users are recommended to upgrade
CVE-2024-23577: Medium severity, CVSS 4.3 | Vulnix