CVE-2024-23571 describes a vulnerability in HCL Aftermarket EPC where the application lacks an appropriate web browser caching policy for sensitive information. This allows sensitive data included in application responses to be stored in the local browser cache. Consequently, unauthorized users with access to the same device could retrieve this cached sensitive information. The vulnerability is classified under CWE-525 (Use of Web Browser Cache of Sensitive Information). The CVSS v3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and limited confidentiality impact. No vendor advisory or patch information is currently available, and no known exploits have been reported in the wild.

The vulnerability may lead to unauthorized disclosure of sensitive information if multiple users share the same computer and browser cache. The confidentiality impact is limited, as exploitation requires local access to the cached data and user interaction. There is no impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or guidance is provided by HCLSoftware, users should consider implementing manual mitigations such as configuring browsers to clear cache on exit or using private browsing modes to reduce the risk of sensitive data being stored in the cache.