CVE-2024-55956

🗓️ 13 Dec 2024 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 421 Views🌐 WEB

Cleo Harmony and VLTrader allow command execution by unauthenticated users due to default settings.

Reporter	Title	Published	Views	Family All 29
zdt	Cleo LexiCom / VLTrader / Harmony 5.8.0.23 Remote Code Execution Exploit	16 Jan 202500:00	–	zdt
attackerkb	CVE-2024-50623	28 Oct 202400:00	–	attackerkb
attackerkb	CVE-2024-55956	13 Dec 202400:00	–	attackerkb
BDU FSTEC	The vulnerabilities of the software platforms Cleo Harmony, VLTrader, and LexiCom are related to errors in the use of standard permissions, allowing a perpetrator to execute arbitrary commands.	19 Dec 202400:00	–	bdu_fstec
Circl	CVE-2024-55956	13 Dec 202421:21	–	circl
CISA KEV Catalog	Cleo Multiple Products Unauthenticated File Upload Vulnerability	17 Dec 202400:00	–	cisa_kev
CISA	CISA Adds One Known Exploited Vulnerability to Catalog	17 Dec 202412:00	–	cisa
Tenable Nessus	Cleo Harmony < 5.8.0.24 Unauthenticated Arbitrary Command Execution (CVE-2024-55956)	17 Dec 202400:00	–	nessus
Tenable Nessus	Cleo LexiCom < 5.8.0.24 Unauthenticated Arbitrary Command Execution (CVE-2024-55956)	17 Dec 202400:00	–	nessus
Tenable Nessus	Cleo VLTrader < 5.8.0.24 Unauthenticated Arbitrary Command Execution (CVE-2024-55956)	17 Dec 202400:00	–	nessus

NVD

Node

cleo harmonyRange<5.8.0.24

cleo lexicomRange<5.8.0.24

cleo vltraderRange<5.8.0.24

Source	Link
support	www.support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Advisory-CVE-Pending
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
support	www.support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update
huntress	www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild

Parameter	Position	Path	Description	CWE
service="AS2"	request body	Synchronization	Unauthenticated write to filesystem via VLSync Synchronization endpoint enabling autorun-based RCE	CWE-77
msgId	request body	Synchronization	Unauthenticated write to filesystem via VLSync Synchronization endpoint enabling autorun-based RCE	CWE-77
path	request body	Synchronization	Unauthenticated write to filesystem via VLSync Synchronization endpoint enabling autorun-based RCE	CWE-77
receiptfolder	request body	Synchronization	Unauthenticated write to filesystem via VLSync Synchronization endpoint enabling autorun-based RCE	CWE-77