CVE-2024-23576: HCL Commerce is potentially affected by a denial of service and information disclosure vulnerability

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-14 · updated 2026-06-17
Weakness: CWE-285

Description

Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations.

Affected products

HCL Software HCL Commerce: from 9.1.12 before 9.1.14 — fixed in 9.1.14

How to fix

Upgrade to a fixed version: HCL Software HCL Commerce 9.1.14. Check the vendor advisory for mitigations.

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0112907
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0112907

Get alerted when CVE-2024-23576 or the next vulnerability affects your stack