CVE-2024-50623

🗓️ 27 Oct 2024 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 21 Media mentions👁 324 Views🌐 WEB

Cleo Harmony, VLTrader, LexiCom JavaScript Injection CVE-2024-5062

Reporter	Title	Published	Views	Family All 36
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Cleo Harmony	31 Dec 202407:43	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Cleo Harmony	23 Dec 202408:52	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Cleo Harmony	1 Apr 202522:55	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Cleo Harmony	11 Dec 202414:19	–	githubexploit
0day.today	Cleo LexiCom / VLTrader / Harmony 5.8.0.23 Remote Code Execution Exploit	16 Jan 202500:00	–	zdt
ATTACKERKB	CVE-2024-50623	28 Oct 202400:00	–	attackerkb
ATTACKERKB	CVE-2024-55956	13 Dec 202400:00	–	attackerkb
BDU FSTEC	The vulnerability of the Cleo Harmony, VLTrader, and LexiCom software platforms lies in their ability to allow unlimited loading of dangerous files, enabling attackers to execute arbitrary code.	27 Jan 202500:00	–	bdu_fstec
Circl	CVE-2024-50623	28 Oct 202401:56	–	circl
CISA KEV Catalog	Cleo Multiple Products Unrestricted File Upload Vulnerability	13 Dec 202400:00	–	cisa_kev

NVD

Vulnrichment

Node

cleo harmonyRange<5.8.0.21

cleo lexicomRange<5.8.0.21

cleo vltraderRange<5.8.0.21

Source	Link
support	www.support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
action	request body	Synchronization	Unrestricted file upload (write) and download (read) via a vulnerable Synchronization endpoint (CVE-2024-50623)	CWE-434
what	request body	Synchronization	Unrestricted file upload (write) and download (read) via a vulnerable Synchronization endpoint (CVE-2024-50623)	CWE-434
where	request body	Synchronization	Unrestricted file upload (write) and download (read) via a vulnerable Synchronization endpoint (CVE-2024-50623)	CWE-434
action	request body	Synchronization	Arbitrary file read and write via the same endpoint supporting read and write actions (CVE-2024-50623)	CWE-434
what	request body	Synchronization	Arbitrary file read and write via the same endpoint supporting read and write actions (CVE-2024-50623)	CWE-434
where	request body	Synchronization	Arbitrary file read and write via the same endpoint supporting read and write actions (CVE-2024-50623)	CWE-434

17 Jun 2026 08:04Current

9.1High risk

Vulners AI Score9.1

CVSS 3.19.8

EPSS0.98529

SSVC