Detections
Analytics
Cleo < 5.8.0.24 Unrestricted File Upload
critical Web App Scanning Plugin ID 114544
Language:
Synopsis
Cleo < 5.8.0.24 Unrestricted File UploadDescription
Cleo Harmony prior to 5.8.0.24, VLTrader prior to 5.8.0.24 and LexiCom prior to 5.8.0.24 are affected by a vulnerability allowing an unauthenticated attacker to upload an arbitrary file that could lead to remote code execution.Solution
Upgrade to Cleo Harmony 5.8.0.24, VLTrader 5.8.0.24, LexiCom 5.8.0.24 or latest.See Also
Plugin Details
Severity: Critical
ID: 114544
Type: remote
Family: Component Vulnerability
Published: 12/19/2024
Updated: 12/19/2024
Scan Template: basic, full, pci, scan
Risk Information
VPR
Risk Factor: High
Score: 7.4
CVSS v2
Risk Factor: High
Base Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2024-55956
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score Source: CVE-2024-55956
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 12/13/2024
Vulnerability Publication Date: 12/13/2024
CISA Known Exploited Vulnerability Due Dates: 1/7/2025
Reference Information
CVE: CVE-2024-55956
CWE: 276
OWASP: 2010-A4, 2013-A4, 2013-A9, 2017-A5, 2017-A9, 2021-A1, 2021-A6
WASC: Insufficient Authorization
DISA STIG: APSC-DV-000500, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(a)(2)(i)
ISO: 27001-A.13.1.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5, 27001-A.18.1.3, 27001-A.6.2.2, 27001-A.9.1.2, 27001-A.9.4.1, 27001-A.9.4.4, 27001-A.9.4.5
NIST: sp800_53-AC-3, sp800_53-CM-6b
OWASP API: 2019-API7, 2023-API8
OWASP ASVS: 4.0.2-14.2.1