CVE-2024-50623

🗓️ 27 Oct 2024 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 21 Media mentions👁 380 Views🌐 WEB

Cleo Harmony, VLTrader, LexiCom JavaScript Injection CVE-2024-5062

Reporter	Title	Published	Views	Family All 40
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Cleo Harmony	31 Dec 202407:43	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Cleo Harmony	23 Dec 202408:52	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Cleo Harmony	1 Apr 202522:55	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Cleo Harmony	11 Dec 202414:19	–	githubexploit
zdt	Cleo LexiCom / VLTrader / Harmony 5.8.0.23 Remote Code Execution Exploit	16 Jan 202500:00	–	zdt
ATTACKERKB	CVE-2024-50623	28 Oct 202400:00	–	attackerkb
ATTACKERKB	CVE-2024-55956	13 Dec 202400:00	–	attackerkb
BDU FSTEC	The vulnerability of the Cleo Harmony, VLTrader, and LexiCom software platforms lies in their ability to allow unlimited loading of dangerous files, enabling attackers to execute arbitrary code.	27 Jan 202500:00	–	bdu_fstec
Circl	CVE-2024-50623	28 Oct 202401:56	–	circl
CISA KEV Catalog	Cleo Multiple Products Unrestricted File Upload Vulnerability	13 Dec 202400:00	–	cisa_kev

NVD

Vulnrichment

Node

cleo harmonyRange<5.8.0.21

cleo lexicomRange<5.8.0.21

cleo vltraderRange<5.8.0.21

Source	Link
support	www.support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
action	query param	/Synchronization	CVE-2024-50623 arbitrary file write PoC via /Synchronization using write action	CWE-434
what	query param	/Synchronization	CVE-2024-50623 arbitrary file write PoC via /Synchronization using write action	CWE-434
where	query param	/Synchronization	CVE-2024-50623 arbitrary file write PoC via /Synchronization using write action	CWE-434
action	query param	/Synchronization	CVE-2024-50623 arbitrary file read PoC via /Synchronization using read action	CWE-434
what	query param	/Synchronization	CVE-2024-50623 arbitrary file read PoC via /Synchronization using read action	CWE-434
where	query param	/Synchronization	CVE-2024-50623 arbitrary file read PoC via /Synchronization using read action	CWE-434

31 Jul 2026 04:16Current

9.1High risk

Vulners AI Score9.1

CVSS 3.19.8

EPSS0.98607

SSVC