Cleo · Multiple Products

CVE-2024-50623

Cleo Multiple Products Unrestricted File Upload Vulnerability

Exploited in attacks Used by ransomware Critical 9.8 Attack chance: 99%

What it is

In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.

CISA: Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: January 3, 2025

Added to the CISA list: December 13, 2024
Published: October 27, 2024
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 99% in the top 0.1% of all known vulnerabilities
Weakness: CWE-434
More details: NVD · CVE.org · CISA

All references (1)

https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory

More exploited flaws from Cleo

Added	Vulnerability	Product	Severity	Attack chance
Dec 17, 2024	Unauthenticated File UploadCVE-2024-55956used by ransomware	Multiple Products	Critical 9.8	94%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.