Critical severity · published Oct 27, 2024
CVE-2024-50623
Cleo Multiple Products Unrestricted File Upload Vulnerability
RansomwareIn wildKEV
9.8
CVSS
98.6%
EPSS
Yes
On KEV
Description
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)98.6% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Dec 13, 2024
Federal remediation dueJan 3, 2025
Ransomware campaign useKnown
Affected products
Which versions
HA
Harmony · Cleo
before 5.8.0.21 · source: NVD
MP
Multiple Products · Cleo
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-50623
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-50623
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
support.cleo.com
https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory
More from Harmony
9.8
CVE-2024-55956
Cleo Multiple Products Unauthenticated File Upload Vulnerability
9.8
CVE-2021-33576
An issue was discovered in Cleo LexiCom 5.5.0.0
8.3
CVE-2026-84115
Cleo Harmony JWT Refresh Token connections privileges management
6.3
CVE-2026-84114
Cleo Harmony SAML Authentication LocalUserUtil.getNativeUserByAssertions improper authentication
5.3
CVE-2021-33577
An issue was discovered in Cleo LexiCom 5.5.0.0