HCLSoftware Aftermarket EPC is affected by an information leakage vulnerability (CWE-204) identified as CVE-2024-23574. The vulnerability arises because the system's responses to authentication attempts differ based on whether a username is valid, enabling attackers to perform brute-force enumeration of valid users. The CVSS 3.1 base score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact. There is no vendor advisory or patch information available at this time.

An attacker can leverage response discrepancies to enumerate valid usernames in the Aftermarket EPC system remotely without authentication. This information leakage can facilitate targeted attacks such as credential stuffing or phishing but does not directly impact system integrity or availability according to current data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing rate limiting or account lockout mechanisms to mitigate brute-force attempts if possible.