# CVE-2024-23575: HCL Aftermarket EPC information disclosure via detailed error messages

Source: https://junglewise.ai/threats/cve-2024-23575-hcl-aftermarket-epc-information-disclosure-via-detailed-error  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2024-23575 · Severity: medium · CVSS 5.3 · Published 2026-07-17

HCL Aftermarket EPC, a platform used for managing electronic parts catalogs, is susceptible to information leakage through its error handling. The application provides overly detailed error messages that reveal internal server processing details to any user on the network. While this does not directly grant access to data, an attacker can use this technical information to map out the system and plan more sophisticated, targeted attacks against the organization.

Technologies: [HCL Software Aftermarket EPC](https://junglewise.ai/threats/technologies/aftermarket-epc). Vendors: [HCL Software](https://junglewise.ai/threats/vendors/hcl-software).

## Quick answers

**Is CVE-2024-23575 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-23575 being exploited in the wild.

**How severe is CVE-2024-23575?** Medium severity, with a CVSS score of 5.3, published 17 July 2026.

**Which products and versions are affected?** HCL Software Aftermarket EPC 1.0.0.

**Is there a fix for CVE-2024-23575?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-23575 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2024-23575?** Check whether you run HCL Software Aftermarket EPC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

HCL Aftermarket EPC version 1.0.0 is vulnerable to CWE-209 (Generation of Error Message Containing Sensitive Information). The application's error handling logic returns verbose technical details about server-side processing directly to the client. This vulnerability is reachable over the network without authentication. An attacker can trigger various error conditions to gather reconnaissance data regarding the underlying infrastructure, software versions, or code logic, which can be leveraged to identify further exploitable vulnerabilities. Users are advised to consult HCL Software advisory KB0132294 for remediation steps.

## Affected products

- HCL Software Aftermarket EPC 1.0.0

## Timeline

- 2026-07-17: disclosed: Initial publication of the CVE record.
- 2026-07-17: advisory: HCL Software released security bulletin KB0132294.

## References

- [https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294](https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294)

## Related threats

- [HCL Aftermarket EPC information disclosure via HTTP OPTIONS method](https://junglewise.ai/threats/cve-2024-42214-hcl-aftermarket-epc-information-disclosure-via-http-options)
- [HCL Aftermarket EPC permissive CORS policy](https://junglewise.ai/threats/cve-2024-23578-hcl-aftermarket-epc-permissive-cors-policy)
- [HCL Aftermarket EPC Host header poisoning](https://junglewise.ai/threats/cve-2024-23577-hcl-aftermarket-epc-host-header-poisoning)
- [HCL Aftermarket EPC user enumeration via response discrepancy](https://junglewise.ai/threats/cve-2024-23574-hcl-aftermarket-epc-user-enumeration-via-response-discrepancy)
- [HCL Aftermarket EPC Lucky 13 timing attack in TLS/DTLS](https://junglewise.ai/threats/cve-2024-23573-hcl-aftermarket-epc-lucky-13-timing-attack-in-tls-dtls)