CVE-2024-23565 describes an issue in HCL Aftermarket EPC where the Forget Password feature does not implement adequate rate limiting on email requests. This improper control of interaction frequency (CWE-799) can be exploited by attackers to perform email flooding, which may lead to denial of service conditions or compromise program logic. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts availability only. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

The vulnerability allows an attacker to flood the system with password reset emails, potentially causing denial of service by overwhelming email resources or affecting application logic. Confidentiality and integrity are not impacted according to the CVSS vector. Availability impact is rated low but could disrupt normal service operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing external rate limiting or monitoring on the password reset functionality to mitigate email flooding risks.