CVE-2024-23573
LowCVSS 3.7Summary
The Lucky 13 vulnerability in HCL Aftermarket EPC allows a man-in-the-middle attack on TLS 1.1, 1.2, DTLS 1.0/1.2, and older SSL 3.0 and TLS 1.0 protocols. An attacker can exploit this flaw to decrypt network traffic.
Risk Assessment
The organization is at risk of interception and decryption of sensitive data transmitted between client and server, potentially leading to information disclosure or communication integrity compromise.
Recommendation
Immediately disable support for SSL 3.0, TLS 1.0, TLS 1.1, and DTLS 1.0, and apply the latest security patches from HCL for Aftermarket EPC.
Original NVD description (English source)
HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that makes the SS LLUCKY13 possible affects the TLS1.1and 1.2 and DTLS1.0 or 1.2 implementations . It also affects previous versions such as SSL3.0 and TLS1.0. This can also be considered a type of man-in-the-middle attack.