CVE-2024-50623 - Cleo Multiple Products Unrestricted File Upload Vulnerability
Project:Cleo
Product:Multiple Products
Date Added:2024-12-13Due Date:2025-01-03
Vulnerability Name
Cleo Multiple Products Unrestricted File Upload Vulnerability
Description
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.
Known To Be Used in Ransomware Campaigns?
Known
Action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Additional Notes
https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update
https://nvd.nist.gov/vuln/detail/CVE-2024-50623
Related News Articles
American Airlines subsidiary Envoy confirms Oracle data theft attackOctober 18, 2025
Harvard investigating breach linked to Oracle zero-day exploitOctober 13, 2025
Clop exploited Oracle zero-day for data theft since early AugustOctober 8, 2025
Oracle patches EBS zero-day exploited in Clop data theft attacksOctober 6, 2025
Oracle links Clop extortion attacks to July 2025 vulnerabilitiesOctober 3, 2025