The vulnerability arises from a CORS misconfiguration where the HCL Aftermarket EPC application sets the Access‑Control‑Allow‑Origin header to a wildcard (*), permitting any external origin to receive data from the endpoint. This flaw is classified as CWE‑942 and, while it does not enable code execution or denial of service, it creates a confidentiality risk by allowing third‑party sites to read sensitive responses. Based on the description, the likely attack vector is a simple client‑side request: an attacker hosts a malicious web page that issues an XMLHttpRequest or fetch to the vulnerable endpoint, automatically receiving the unrestricted response data without any authentication requirement.

The affected product is HCL Software Aftermarket EPC. No specific versions are listed in the advisory, so all installations of Aftermarket EPC are treated as potentially vulnerable until the vendor releases a fix. There is no indication that the issue is limited to particular modules or configuration settings.

The CVSS score of 4.2 places this issue in the moderate range. The EPSS score of <1% indicates a very low likelihood of exploitation, and the flaw is not listed in CISA’s KEV catalog. Attackers can exploit it by hosting a malicious web page that makes requests to the vulnerable endpoint; the response headers permit any origin to read the data. No additional prerequisites beyond normal network connectivity appear to be required.