CVE-2024-23564 Business logic in Aftermarket EPC
Attackers can steal user passwords by manipulating email requests due to missing validation, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-23564?
CVE-2024-23564 is a critical vulnerability in HCL Software Aftermarket EPC, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redirect them to their own email address by manipulating the server's response. The application includes checks in the initial requests to verify the validity of the provided UserId, but similar validation is not applied to Email requests when sending passwords to user emails.
Weakness: CWE-326
Which versions are affected by CVE-2024-23564?
How do I fix CVE-2024-23564?
No fix has been published for CVE-2024-23564 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-23564 being exploited?
There is no known exploitation of CVE-2024-23564 in the wild and no public exploit code.
Sources
Also known as GHSA-wmr2-f2gc-hxq6.