Executive brief
HCL Aftermarket EPC, a platform used for managing electronic parts catalogs, is missing a standard security configuration that helps prevent web-based attacks. This omission makes it easier for attackers to perform cross-site scripting (XSS) attacks against users of the system. If exploited, this could lead to unauthorized access to user session information or the display of malicious content to legitimate users.
Technical details
HCL Aftermarket EPC version 1.0.0 fails to implement the 'X-XSS-Protection' HTTP response header. This header is a security feature intended to enable the Cross-Site Scripting (XSS) filter built into most modern web browsers. The absence of this header, classified under CWE-692, increases the risk of reflected XSS attacks. An attacker could potentially leverage this misconfiguration to execute malicious scripts in a victim's browser context, provided they can entice a user to click a specially crafted link. While many modern browsers have deprecated this specific header in favor of Content Security Policy (CSP), its absence in this product is noted as a security weakness by the vendor.
Affected products
- HCL Software Aftermarket EPC 1.0.0
Timeline
- 2026-07-17: disclosed
- 2026-07-17: advisory