In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.

In the wild exploitation has been observed. Vendor updates should be released soon and mitigation guidance has been issued.

The version of Cleo Harmony running on the remote host is prior to 5.8.0.21. It is, therefore, affected by an unrestricted file upload and download vulnerability.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Cleo VLTrader running on the remote host is prior to 5.8.0.21. It is, therefore, affected by an unrestricted file upload and download vulnerability.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Cleo LexiCom running on the remote host is prior to 5.8.0.21. It is, therefore, affected by an unrestricted file upload and download vulnerability.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Cleo Harmony prior to 5.8.0.21, VLTrader prior to 5.8.0.21 and LexiCom prior to 5.8.0.21 are affected by a vulnerability allowing an unauthenticated attacker to read an arbitrary file or upload an arbitrary file that could lead to remote code execution.

ID	Name	Product	Family	Severity
213295	Cleo Harmony < 5.8.0.21 Unrestricted File Upload/Download (CVE-2024-50623)	Nessus	CGI abuses	critical
213294	Cleo VLTrader < 5.8.0.21 Unrestricted File Upload/Download (CVE-2024-50623)	Nessus	CGI abuses	critical
213293	Cleo LexiCom < 5.8.0.21 Unrestricted File Upload/Download (CVE-2024-50623)	Nessus	CGI abuses	critical
114542	Cleo < 5.8.0.21 Unrestricted File Read/Upload	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2024-50623

critical

Tenable Plugins

critical

critical

critical

critical