Security Resilience

CVE-2024-23569

Published
17 July 2026
Modified
02 October 2026
CVSS Score v3.1 4.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
EPSS Score 0.0030 21th percentile
Risk Priority 36 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-23569 is a medium-severity Incomplete Denylist to Cross-Site Scripting (CWE-692) vulnerability in Hcl Software (inferred from references). Its CVSS base score is 4.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" header

CWE(s)
CWE-692

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001.001 Junk Data Command And Control
Adversaries may add junk data to protocols used for command and control to make detection more difficult.
attack.mitre.org →
T1003.001 LSASS Memory Credential Access
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
attack.mitre.org →
T1003.003 NTDS Credential Access
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.
attack.mitre.org →
T1003.005 Cached Domain Credentials Credential Access
Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.
attack.mitre.org →
T1003.006 DCSync Credential Access
Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citati…
attack.mitre.org →
T1003.008 /etc/passwd and /etc/shadow Credential Access
Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-20240Shared CWE-692
CVE-2026-15295Shared CWE-692
CVE-2024-30924Shared CWE-692
CVE-2025-49590Shared CWE-692
CVE-2024-42214Shared CWE-692
CVE-2024-52305Shared CWE-692
CVE-2025-53904Shared CWE-692
CVE-2023-26047Shared CWE-692

Affected Assets

Hcl Software
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match

Input validation requires complete, allowlist-style checks that structurally eliminate reliance on incomplete XSS denylists.

SA-8 Security and Privacy Engineering Principles partial match

Security engineering principles mandate robust sanitization and validation approaches that avoid incomplete denylist patterns.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
blocks

Secure SDLC practices directly require robust input validation and sanitization (e.g., allowlists) rather than incomplete denylists for XSS.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.10 Acceptable use of information and other associated assets partial match
removes
A.8.25 Secure development life cycle partial match
blocks

A.8.25 mandates secure SDLC practices including secure coding guidelines, security requirements, checkpoints, testing (scans/penetration), and developer training that can catch or block many (but not all) incomplete denylist cases before they ship; a minority slice remains where flawed denylists still reach production and can be exploited.

A.8.26 Application security requirements partial match
blocks

Application-security requirements can mandate proper output encoding, but the control itself does not prescribe the technique.

A.8.28 Secure coding partial match
prevents

Secure-coding rules directly require allow-list or context-aware escaping instead of incomplete denylists for XSS.

A.8.29 Security testing in development and acceptance partial match
finds

Security testing can discover incomplete denylists, yet the control does not mandate their replacement.

A.8.8 Management of technical vulnerabilities partial match
removes

References