VulnerabilityDeferred

CVE-2024-23567

HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during normal usage.

MEDIUM 4.3EPSS 0.31%

Does this matter?

Lower severity and a low EPSS score (0.31%). Track it; it rarely justifies an emergency change on its own.

Description

HCL Aftermarket EPC is affected by Sensitive Information in GET method & in URL which allows application to pass sensitive data via URL parameters during normal usage. Data passed in this manner can be exposed because it may end up stored in unintended locations, including server logs, local browser history and proxy logs.

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
EPSS: 0.31% probability · 23th percentile
CISA KEV: Not listed
Weakness: CWE-804
Source: psirt@hcl.com

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.