Cleo software: JavaScript Injection and unrestricted file upload/download (CVE-2024-50623) #shorts

CVE

This CVE-2024-50623 describes a critical security vulnerability found in Cleo software, specifically affecting versions of Cleo Harmony, VLTrader, and LexiCom prior to 5.8.0.21. It includes two primary issues: a JavaScript Injection vulnerability and an unrestricted file upload and download weakness. When exploited, these vulnerabilities can allow attackers to remotely execute arbitrary code on affected systems. The JavaScript Injection flaw enables malicious scripts to be executed, potentially compromising sensitive information. The unrestricted file handling vulnerability could lead to unauthorized data access, manipulation, and further system exploitation. These vulnerabilities have been actively exploited in the wild, posing significant risks to organizations utilizing these Cleo software versions.

This chain involves the following actors

This following systems are involved

Attack entry point

Remediation actions

Exploitation actions

• https://support.cleo.com/hc/en-us/articles/27140294267799-Cleo-Product-Security-Advisory