The vulnerability identified as CVE-2024-23564 in HCL Aftermarket EPC involves inadequate validation in the password recovery or email sending process. While the application checks the validity of UserId in initial requests, it does not validate email requests properly, enabling an attacker to manipulate server responses to extract passwords and redirect them to an attacker-controlled email address. This is categorized under CWE-326, indicating inadequate encryption strength or protection mechanisms related to sensitive data handling. The CVSS 3.1 score of 9.1 reflects the critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact.

An unauthenticated attacker can exploit this vulnerability to obtain user passwords from the server and redirect them to an attacker-controlled email address. This compromises user credentials, leading to potential unauthorized access and data breaches. The confidentiality and integrity of user data are severely impacted, but availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or mitigation is provided by HCL Software, organizations should monitor vendor communications closely. No specific temporary mitigations are documented in the provided data.