In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is in the KEV database since Dec. 13, 2024.

Exploitation active

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Cleo
  • Harmomy
  • Harmony
  • Lexicom
  • Vltrader

Configuration 1 [-]

OR cpe:2.3:a:cleo:harmony:*:*:*:*:*:*:*:*
cpe:2.3:a:cleo:lexicom:*:*:*:*:*:*:*:*
cpe:2.3:a:cleo:vltrader:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory cve-icon cve-icon
History

Fri, 20 Dec 2024 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Cleo harmony
CPEs cpe:2.3:a:cleo:harmony:*:*:*:*:*:*:*:*
Vendors & Products Cleo harmony

Tue, 17 Dec 2024 22:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Sat, 14 Dec 2024 00:15:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2024-12-13'}

Fri, 13 Dec 2024 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 10 Dec 2024 20:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79

Tue, 10 Dec 2024 20:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-434

Fri, 15 Nov 2024 15:30:00 +0000

Type Values Removed Values Added
Description In Cleo Harmony before 5.8.0.20, VLTrader before 5.8.0.20, and LexiCom before 5.8.0.20, there is a JavaScript Injection vulnerability: unrestricted file upload and download could lead to remote code execution. In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.

Wed, 30 Oct 2024 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Cleo
Cleo harmomy
Cleo lexicom
Cleo vltrader
Weaknesses CWE-79
CPEs cpe:2.3:a:cleo:harmomy:*:*:*:*:*:*:*:*
cpe:2.3:a:cleo:lexicom:*:*:*:*:*:*:*:*
cpe:2.3:a:cleo:vltrader:*:*:*:*:*:*:*:*
Vendors & Products Cleo
Cleo harmomy
Cleo lexicom
Cleo vltrader
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 28 Oct 2024 20:45:00 +0000

Type Values Removed Values Added
Description In Cleo Harmony before 5.8.0.20, VLTrader before 5.8.0.20, and LexiCom before 5.8.0.20, there is a JavaScript Injection vulnerability. In Cleo Harmony before 5.8.0.20, VLTrader before 5.8.0.20, and LexiCom before 5.8.0.20, there is a JavaScript Injection vulnerability: unrestricted file upload and download could lead to remote code execution.

Sun, 27 Oct 2024 23:30:00 +0000

Type Values Removed Values Added
Description In Cleo Harmony before 5.8.0.20, VLTrader before 5.8.0.20, and LexiCom before 5.8.0.20, there is a JavaScript Injection vulnerability.
References
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-10-27T00:00:00

Updated: 2024-12-17T21:13:21.849Z

Reserved: 2024-10-27T00:00:00

Link: CVE-2024-50623

cve-icon Vulnrichment

Updated: 2024-10-30T20:12:26.927Z

cve-icon NVD

Status : Analyzed

Published: 2024-10-28T00:15:03.657

Modified: 2024-12-20T15:04:26.097

Link: CVE-2024-50623

cve-icon Redhat

No data.