CVE-2024-23577 Other in Aftermarket EPC
HCL Aftermarket EPC fails to validate the Host header, allowing attackers to perform Host header poisoning and potentially bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-23577?
CVE-2024-23577 is a medium-severity vulnerability in HCLSoftware Aftermarket EPC, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
HCL Aftermarket EPC is vulnerable since the application does not have a validation for HOST header and accepts arbitrary hosts when requested in http protocol. When an application doesn’t adequately validate or sanitize this header, it can lead to several security risks, including Host header poisoning, server misconfigurations.
Weakness: CWE-20
Which versions are affected by CVE-2024-23577?
How do I fix CVE-2024-23577?
No fix has been published for CVE-2024-23577 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-23577 being exploited?
There is no known exploitation of CVE-2024-23577 in the wild and no public exploit code.
Sources
Also known as GHSA-6qrw-2f8j-667h.