CVE-2024-23577: CWE-20: Improper Input Validation in HCLSoftware Aftermarket EPC
HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requested in http protocol. When an application doesn’t adequately validate or sanitize this header, it can lead to several security risks, including Host header poisoning, server misconfigurations.
AI Analysis
Technical Summary
CVE-2024-23577 describes an improper input validation vulnerability (CWE-20) in HCLSoftware's Aftermarket EPC product. The application fails to validate the HOST header in HTTP requests, accepting arbitrary host values. This lack of validation can enable Host header poisoning attacks and cause server misconfigurations. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.3, reflecting low confidentiality impact and no integrity or availability impact. There is no vendor advisory or patch information available at this time.
Potential Impact
The vulnerability allows an attacker to supply arbitrary HOST header values, which may lead to Host header poisoning and server misconfiguration issues. The impact is limited to potential confidentiality concerns without direct integrity or availability effects. No known exploits are reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No specific mitigations are provided by the vendor at this time.
CVE-2024-23577: CWE-20: Improper Input Validation in HCLSoftware Aftermarket EPC
Description
HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requested in http protocol. When an application doesn’t adequately validate or sanitize this header, it can lead to several security risks, including Host header poisoning, server misconfigurations.
CVSS v3.1
Score 4.3medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-23577 describes an improper input validation vulnerability (CWE-20) in HCLSoftware's Aftermarket EPC product. The application fails to validate the HOST header in HTTP requests, accepting arbitrary host values. This lack of validation can enable Host header poisoning attacks and cause server misconfigurations. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.3, reflecting low confidentiality impact and no integrity or availability impact. There is no vendor advisory or patch information available at this time.
Potential Impact
The vulnerability allows an attacker to supply arbitrary HOST header values, which may lead to Host header poisoning and server misconfiguration issues. The impact is limited to potential confidentiality concerns without direct integrity or availability effects. No known exploits are reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No specific mitigations are provided by the vendor at this time.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- HCL
- Date Reserved
- 2024-01-18T07:29:59.077Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5b5eca2d1edb114c7fbfe4
Added to database: 07/18/2026, 11:08:58 UTC
Last enriched: 07/18/2026, 12:06:50 UTC
Last updated: 07/18/2026, 13:16:07 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.