CVE-2024-50623
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
These software products allow users to upload files without proper validation, which attackers can exploit to upload malicious files and execute code on the server. This is a critical flaw because it gives attackers complete control over the affected system.
CWE-434 unrestricted file upload vulnerability in Cleo Harmony, VLTrader, and LexiCom versions before 5.8.0.21 permits unauthenticated or authenticated attackers to upload arbitrary files without extension or content validation, leading to remote code execution on the server. The attack requires network access to the upload interface but no special privileges or user interaction.
The full analysis of this CVE is available in Portuguese →