CVE-2024-23572: HCL Aftermarket EPC Session Vulnerability

CVE-2024-23572 Overview

CVE-2024-23572 affects HCL Aftermarket EPC, where a cookie appears to contain a session token without the security attributes required to protect it. Because session tokens govern authenticated access, weak cookie handling raises the risk of session disclosure or misuse. The weakness is categorized under [CWE-614], which covers sensitive cookies transmitted without the Secure attribute. The vulnerability requires network access and user interaction, and it can leak limited confidentiality and integrity of user session data.

Critical Impact
An attacker positioned on the network path may intercept or manipulate the session cookie, potentially enabling session hijacking against HCL Aftermarket EPC users.

Affected Products

HCL Aftermarket EPC

Discovery Timeline

2026-07-17 - CVE-2024-23572 published to the National Vulnerability Database (NVD)
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2024-23572

Vulnerability Analysis

HCL Aftermarket EPC issues a cookie that appears to carry a session token. According to the vendor advisory, the cookie lacks protective attributes expected for sensitive session material. Administrators are directed to review the cookie contents to determine its function and sensitivity.

The issue maps to [CWE-614]: Sensitive Cookie in HTTPS Session Without Secure Attribute. When a session cookie omits the Secure flag, browsers may transmit it over cleartext HTTP under certain conditions. An attacker able to observe network traffic could then capture the token and reuse it to impersonate the victim.

The EPSS probability is 0.086% at the 40.3rd percentile as of 2026-07-24, indicating low near-term exploitation likelihood. No public proof-of-concept, exploit tooling, or CISA KEV listing exists for this issue.

Root Cause

The root cause is improper configuration of the session cookie. Security attributes such as Secure, HttpOnly, and SameSite govern how browsers transmit and expose cookies. Missing or misconfigured attributes on a session identifier weaken transport and script-access protections that normally prevent theft.

Attack Vector

Exploitation requires network access and user interaction. An attacker on the same network segment, or one who can influence routing, must observe or coerce traffic from a legitimate user session. High attack complexity reflects the need for a suitable network position and a triggering user action. Successful capture of the session token allows the attacker to interact with the application as the victim within the session lifetime.

No verified exploitation code is available. See the HCL Software Knowledge Base Article for vendor-supplied technical detail.

Detection Methods for CVE-2024-23572

Indicators of Compromise

HTTP requests to HCL Aftermarket EPC containing session cookies transmitted without the Secure attribute over cleartext channels.
Concurrent authenticated sessions from geographically or network-distinct sources reusing the same session token.
Anomalous access patterns to Aftermarket EPC endpoints outside normal user working hours or from unexpected user agents.

Detection Strategies

Inspect application response headers for Set-Cookie directives that omit Secure, HttpOnly, or a restrictive SameSite attribute on session identifiers.
Correlate authentication events with source IP and device fingerprint to identify token reuse across dissimilar clients.
Review web proxy and load balancer logs for HTTP (non-TLS) requests carrying session cookies destined for Aftermarket EPC hosts.

Monitoring Recommendations

Enable full HTTP transaction logging on reverse proxies fronting HCL Aftermarket EPC and retain Set-Cookie and Cookie header metadata.
Alert when a session token is observed from more than one client IP or user-agent within a short window.
Monitor for cleartext HTTP traffic to Aftermarket EPC hostnames and flag any occurrences for investigation.

How to Mitigate CVE-2024-23572

Immediate Actions Required

Review the HCL Aftermarket EPC deployment to identify the cookie flagged in the advisory and confirm whether it holds session state.
Enforce HTTPS across all Aftermarket EPC endpoints and disable HTTP listeners or redirect them to TLS.
Apply the guidance provided in the HCL Software Knowledge Base Article.

Patch Information

HCL has published guidance in HCL Software Knowledge Base Article KB0132294. Administrators should follow the vendor instructions to review cookie behavior and apply configuration or product updates as directed.

Workarounds

Configure the web server or reverse proxy to append the Secure, HttpOnly, and SameSite=Strict attributes to session cookies issued by Aftermarket EPC.
Enable HTTP Strict Transport Security (HSTS) on the application domain to prevent downgrade to cleartext HTTP.
Shorten session lifetimes and require re-authentication for sensitive operations to reduce the value of a stolen token.

bash

# Configuration example: rewrite Set-Cookie on an nginx reverse proxy
# to add Secure, HttpOnly, and SameSite attributes to session cookies
proxy_cookie_flags ~ secure httponly samesite=strict;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;