CVE-2024-50623 - Cleo Multiple Products Unrestricted File Upload Vulnerability
Project:Cleo
Product:Multiple Products
Date Added:2024-12-13Due Date:2025-01-03
Vulnerability Name
Cleo Multiple Products Unrestricted File Upload Vulnerability
Description
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.
Known To Be Used in Ransomware Campaigns?
Known
Action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Additional Notes
https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update
https://nvd.nist.gov/vuln/detail/CVE-2024-50623
Related News Articles
Retail giant Sam’s Club investigates Clop ransomware breach claimsMarch 29, 2025
Western Alliance Bank notifies 21,899 customers of data breachMarch 19, 2025
Leaked Black Basta Ransomware Chat Logs Reveal Inner Workings and Internal ConflictsFebruary 26, 2025
Clop ransomware is now extorting 66 Cleo data-theft victimsDecember 24, 2024
Clop ransomware claims responsibility for Cleo data theft attacksDecember 16, 2024
