CVE-2024-23578 describes a vulnerability in HCL Aftermarket EPC where the application implements an HTML5 cross-origin resource sharing (CORS) policy that uses a wildcard (*) to allow access from any domain. This incomplete restriction can enable unauthorized cross-origin requests, potentially exposing sensitive information or allowing limited manipulation of data. The vulnerability is classified under CWE-942 (Incomplete Denial of Resource Access) and CWE-692. No specific affected versions or patches have been identified in the provided data.

The vulnerability allows cross-origin requests from any domain, which may lead to limited confidentiality and integrity impacts as indicated by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: None). There is no indication of known exploits in the wild. The attack complexity is high and requires user interaction, reducing the likelihood of widespread exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor HCLSoftware advisories for updates. Until a fix is available, consider restricting CORS policies manually if possible to limit access to trusted domains only.