CVE-2024-23570
MediumCVSS 4.3Summary
HCL Aftermarket EPC is affected by a clickjacking vulnerability (Cross-Frame Scripting), allowing an attacker to load the vulnerable application in an iFrame on a malicious site. The attacker can then launch a clickjacking attack, potentially leading to phishing, Cross-Site Request Forgery (CSRF), sensitive information leakage, and more.
Risk Assessment
The organization is at risk of credential theft, unauthorized actions within the system, and leakage of sensitive business information through user interface manipulation.
Recommendation
Update HCL Aftermarket EPC to the latest patched version and implement security headers (X-Frame-Options, Content-Security-Policy) in the web server configuration.
Other vulnerabilities in HCL Aftermarket EPC
See all- CVE-2024-42214Medium
The vulnerability in HCL Aftermarket EPC is due to the HTTP OPTIONS method being enabled on the web server. This method discloses a list of supported HTTP methods, allowing an attacker to narrow down and intensify their attacks.
- CVE-2024-23578Medium
The vulnerability in HCL Aftermarket EPC is due to a misconfigured CORS policy that allows access from any domain (wildcard '*'). This enables attackers to perform cross-origin requests from external sites.
- CVE-2024-23577Medium
The vulnerability in HCL Aftermarket EPC is due to the lack of validation of the HOST header in HTTP requests, allowing arbitrary hosts to be accepted. This can lead to Host header poisoning and server misconfigurations.
- CVE-2024-23575Medium
The vulnerability in HCL Aftermarket EPC involves returning detailed error messages that leak information about server-side processing. An attacker can use this information to launch a more targeted attack.
- CVE-2024-23574Medium
A vulnerability in HCL Aftermarket EPC allows an attacker to use brute-force techniques to guess or confirm valid users in the system. This attack can lead to confidentiality breaches by identifying user accounts.
- CVE-2024-23573Low
The Lucky 13 vulnerability in HCL Aftermarket EPC allows a man-in-the-middle attack on TLS 1.1, 1.2, DTLS 1.0/1.2, and older SSL 3.0 and TLS 1.0 protocols. An attacker can exploit this flaw to decrypt network traffic.
- CVE-2024-23572Medium
The vulnerability in HCL Aftermarket EPC is due to a session token being stored in a cookie, increasing the attack risk. The cookie's content should be reviewed to determine its function.
- CVE-2024-23571Medium
The vulnerability in HCL Aftermarket EPC is caused by the lack of an appropriate caching policy, allowing sensitive data to be stored in the local cache. Other users with access to the same computer may later retrieve this data.
- CVE-2024-23569Medium
Missing X-XSS-Protection header in HCL Aftermarket EPC server allows potential Cross-Site Scripting (XSS) attacks. This vulnerability stems from improper HTTP security configuration.
- CVE-2024-23568Medium
The vulnerability in HCL Aftermarket EPC exposes the web server software version, allowing an attacker to identify potential security flaws, especially if an outdated version with known vulnerabilities is in use.
Original NVD description (English source)
HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack technique where an attacker loads a vulnerable application in an iFrame on his malicious site. The attacker can then launch a Clickjacking attack, which may lead to Phishing, Cross-Site Request Forgery, sensitive information leakage and more.