Is CVE-2024-23565 exploitable?

No community verdicts yet for CVE-2024-23565. Be the first to weigh in.

Is CVE-2024-23565 a false positive?

No community verdicts yet for CVE-2024-23565.

How do I remediate CVE-2024-23565?

See the authoritative references (NVD, vendor advisory) and community field notes on this page for remediation guidance.

CVE-2024-23565

Is CVE-2024-23565 real, exploitable, or a false positive? Here's the community verdict.

☆ Watch

signals

public sources

Exploited in wild

Not listed

CISA KEV

Public exploit

None known

Metasploit/EDB/PoC

Base severity

5.3 Medium

CVSS

Exploitation prob.

0.2%

FIRST EPSS

Weakness

CWE-799

CWE

Moderate signals. Triage by your actual exposure and reachability.

baseline read

auto · not a community verdict

Low signal — verdict needed

Few public signals point to active risk. Whether a scanner hit here is a true or false positive depends on your version and config — community verdicts decide.

Based on CVSS · FIRST EPSS

Confirm or dispute →

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password functionality. The actor could b e a human or an automated process such as a virus or bot. This could be used to cause a denial of service, compromise program logic or other consequences.

References

NVD MITRE CVE.org

Published Jul 17, 2026

Embed this verdict

Markdown

[![TruePositive verdict](https://www.truepositive.app/cve/CVE-2024-23565/badge.svg)](https://www.truepositive.app/cve/CVE-2024-23565)

HTML

<a href="https://www.truepositive.app/cve/CVE-2024-23565"><img src="https://www.truepositive.app/cve/CVE-2024-23565/badge.svg" alt="TruePositive verdict for CVE-2024-23565"></a>

Live badge that updates automatically as the community verdict changes.

Community ground truth

Be the first practitioner to weigh in

So far this is only TruePositive's editorial baseline from public sources. Add your real-world verdict below — it becomes the signal the next person triaging this relies on.

🥇 The first 50 practitioners to contribute earn a Founding Contributor badge.

In your experience, is this finding real and exploitable?

awaiting field verdicts

Real, but not a risk here

Not a real issue

Curated baseline: A curated baseline from public sources, shown separately from community verdicts.

No account needed. Anonymous verdicts post as an unverified signal. Log in to make yours verified and earn reputation.

Field notes & remediation

Verdicts are the quick signal. Notes are the evidence and fixes behind them.

0
Field note · TruePositive EditorialCurated
No confirmed in-the-wild exploitation or public exploit was found for this yet.

Add a field note or remediationoptional

Same weakness: CWE-799.

CVE-2026-33434MED 4.3EPSS 0%
Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.6.0 and above, prior to 4.14.5, a logic error in CheckRateLimitsMiddleware.dispatch() causes the /events endpoint rate check to unconditionally overwrite the general rate limit result. When the global max_request_per_minute is exceeded, requests to /events still succeed if the events-specific counter (hardcoded 30/min) has not been reached. This allows event injection into analysisd beyond the admin-configured global rate limit. This issue has been fixed in version 4.14.5.

CVE-2024-23565

Community ground truth

Field notes & remediation

Related CVEs