Description

Cleo Harmony, VLTrader, and LexiCom contain arbitrary file read/write vulnerabilities that leads to remote code execution. Successful exploitation of the vulnerability can result in takeover of the server.

Remediation

Upgrade to the latest version of Cleo software

References

Cleo Product Security Update - CVE-2024-55956

Cleo Product Security Advisory - CVE-2024-50623

Cleo Harmony, VLTrader, and LexiCom - RCE via Arbitrary File Write (CVE-2024-50623)

Technical Analysis CVE-2024-55956

Related Vulnerabilities

phpMyFAQ Other Vulnerability (CVE-2004-2255)

Jboss EAP CVE-2023-3223 Vulnerability (CVE-2023-3223)

Sqlite Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2019-19925)

Atlassian Jira Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2021-41306)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-2246)

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Tags

Arbitrary File Read Arbitrary File Write Known Vulnerabilities CWE-434 CVE-2024-50623 CVE-2024-55956