CVE-2024-23575 describes a vulnerability in HCL Aftermarket EPC where the application returns detailed error messages containing sensitive information about server processing. This information disclosure (CWE-209) can aid attackers in understanding the internal workings of the application, potentially facilitating further attacks. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity), with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact. No remediation level or patch information is currently available, and no known exploits are reported in the wild.

The vulnerability leads to the disclosure of sensitive information through error messages, which may help attackers in reconnaissance and planning subsequent attacks. The confidentiality impact is limited, and there is no impact on integrity or availability according to the CVSS vector. No direct exploitation or damage is reported, but the information leakage could increase the risk of more focused attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider configuring the application to suppress detailed error messages or to log them internally without exposing sensitive details to end users. Monitor vendor communications for updates on patches or official mitigations.