Executive brief
HCL Aftermarket EPC, a platform used for managing electronic parts catalogs, contains a flaw where sensitive information is transmitted through web addresses (URLs). This data can be inadvertently recorded in server logs, browser history, or by network proxies, potentially exposing private information to unauthorized individuals who gain access to those logs. While this does not directly crash the system, it creates a risk of data leakage during normal operation.
Technical details
HCL Aftermarket EPC version 1.0.0 is vulnerable to information exposure because it transmits sensitive data using the HTTP GET method. By placing sensitive information within URL parameters, the application risks exposing that data to any system that logs URLs, such as web server access logs, forward/reverse proxies, and local browser history. An attacker with access to these logs or the user's local environment could retrieve sensitive session or application data. The vulnerability is categorized under CWE-598 (Information Exposure Through Query Strings in GET Request), although the advisory also mentions CWE-804. Remediation details should be sought from HCL advisory KB0132294.
Affected products
- HCL Software Aftermarket EPC 1.0.0
Timeline
- 2026-07-17: advisory: Initial disclosure by HCL Software