CVE-2024-23564

Name of the Vulnerable Software and Affected Versions HCL Aftermarket EPC (affected versions not specified)

Description A business logic flaw allows an unauthorized user to obtain server passwords and redirect them to their own email address by manipulating the server response. While the application validates the UserId during initial requests, it fails to perform similar validation during email requests used for sending passwords to users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.