CVE-2024-50623

Description

In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.

Reserved 2024-10-27 | Published 2024-10-27 | Updated 2024-12-23 | Assigner mitre

CISA Known Exploited Vulnerability

Date added 2024-12-13 | Due date 2025-01-03

Known Ransomware Campaign(s)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Problem types

CWE-434 Unrestricted Upload of File with Dangerous Type

References

support.cleo.com/...294267799-Cleo-Product-Security-Advisory

cve.org (CVE-2024-50623)

nvd.nist.gov (CVE-2024-50623)

Download JSON