CVE-2024-23578
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-23578 is a medium-severity Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942) vulnerability in Hcl Software (inferred from references). Its CVSS base score is 4.2 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Steganography (T1001.002); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SC-7 (Boundary Protection) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-55670
Vulnerability Data
HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS) policy for this request that allows access from any domain (*-Wildcard).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.4.3V3.4.6V3.5.2
Mitigating Controls (NIST 800-53 r5) AI
Information flow enforcement requires approved authorizations and would reject policies permitting untrusted domains.
Boundary protection at external interfaces stops unauthorized cross-domain communication allowed by permissive policies.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability identification processes can surface permissive policy misconfigurations.
Hardened configuration baselines and reviews directly prevent permissive CSP or cross-domain policies.
Secure SDLC activities include review and testing of web security policies to avoid untrusted domains.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Network security policies can restrict cross-domain communication but do not specifically mandate strict CSP or cross-domain policy configuration.
Security of network services includes defining allowed endpoints, which can limit untrusted domains but does not directly address web-client policy files.
Web filtering can block untrusted domains at the network level, partially mitigating permissive cross-domain policies.
A.8.26 only requires that security requirements (including resilience against attacks such as injections) be identified and specified during development or acquisition; it does not itself enforce, implement, or configure any cross-domain policy, CSP, or domain whitelist that would stop exploitation of a permissive policy allowing untrusted domains.
A.8.27 mandates security-by-design, defense-in-depth, least-privilege, assume-breach, distrust-external-input, and explicit review against known attack patterns (including permissive cross-domain policies); this stops exploitation in many but not all cases (e.g. when the policy is supplied by a third-party component or when the review misses a novel untrusted domain).
Secure coding practices require proper configuration of CSP and cross-domain policies to avoid untrusted domains.