CVE-2024-23572 describes a vulnerability in HCL Aftermarket EPC related to the use of a sensitive cookie in an HTTPS session that lacks the 'Secure' attribute. The cookie appears to contain a session token, which could increase the risk of interception or misuse if the cookie is transmitted over non-secure channels or accessed by unauthorized parties. The vulnerability is classified under CWE-614 (Sensitive Cookie in HTTPS Session Without 'Secure' Attribute). No specific affected versions or patches are currently documented.

The vulnerability may allow an attacker to obtain or misuse session tokens if the cookie is transmitted without the 'Secure' flag, potentially leading to limited confidentiality and integrity impacts. The CVSS vector indicates a network attack vector with high attack complexity, no privileges required, user interaction required, and low impact on confidentiality and integrity, with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review the cookie settings in HCL Aftermarket EPC to ensure the 'Secure' attribute is set on cookies containing sensitive session tokens to prevent transmission over non-secure channels.