{"basis":"claimed","id":"CVE-2024-55956","name":"Cleo Multiple Products Unauthenticated File Upload Vulnerability","vendorProject":"Cleo","product":"Multiple Products","publishedAt":"2024-12-13","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"exploited":{"kevAdded":"2024-12-17","dueDate":"2025-01-07","ransomware":true},"epss":{"score":0.93968,"percentile":0.99846,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"blocks","firstOn":"2025-01-13","daysToRule":31},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2025-01-21","daysToRule":39},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":null,"description":"In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.","cwes":["CWE-276"],"vendors":[{"vendor":"cloudflare","status":"blocks","basis":"claimed","firstOn":"2025-01-13","firstIsNew":true,"daysToRule":31,"daysAtMost":null,"freePlan":false,"claims":[{"id":"6c630c5abc1a04363b7afbf8edf8896d6efb86ba5a8eb1022db011e9b0d647f5","cve_id":"CVE-2024-55956","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"6e0bfbe4b9c6454c8bd7bd24f49e5840","rule_name":"Cleo Harmony - Auth Bypass - CVE:CVE-2024-55956, CVE:CVE-2024-55953","change":"new","default_action":"Block","published_on":"2025-01-13","source_url":"https://developers.cloudflare.com/changelog/post/2025-01-13-waf-release/","source_title":"WAF Release - 2025-01-13","excerpt":"Cleo Harmony - Auth Bypass - CVE:CVE-2024-55956, CVE:CVE-2024-55953. Previous action: Log. New action: Block. New Detection","first_seen_at":"2026-11-02T21:00:16.956Z"}]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2025-01-21","firstIsNew":true,"daysToRule":39,"daysAtMost":null,"freePlan":false,"claims":[{"id":"a40556aae12d3ce2a6ee363f4af21372ab50f05e0011bb7c70e99c4658e38899","cve_id":"CVE-2024-55956","vendor":"f5","product":"Attack signatures","rule_id":"200104999","rule_name":"Cleo MFT Arbitrary File Upload","change":"new","default_action":null,"published_on":"2025-01-21","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200104999 \"Cleo MFT Arbitrary File Upload\" (Server Side Code Injection, risk High), systems: Java Servlets/JSP, Other Web Server. References: CVE-2024-55956.","first_seen_at":"2026-11-02T21:00:26.849Z"},{"id":"7cf18a45d92f3aa1f5f4b075a994111f9d25036c50fefdc22966f3a116896a17","cve_id":"CVE-2024-55956","vendor":"f5","product":"Attack signatures","rule_id":"200104999","rule_name":"Cleo MFT Arbitrary File Upload","change":"new","default_action":null,"published_on":"2025-03-11","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200104999 \"Cleo MFT Arbitrary File Upload\" (Server Side Code Injection, risk High), systems: Java Servlets/JSP, Other Web Server. References: CVE-2024-55956.","first_seen_at":"2026-11-02T21:00:26.672Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T23:17:42.096Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","ssvc":{"exploitation":"active","automatable":"no","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"blocked","templateId":"CVE-2024-55956","templatePath":"http/cves/2024/CVE-2024-55956.yaml","requests":2,"blockedRequests":2,"rules":["920420"],"note":"","requestDetail":[{"method":"POST","path":"/Synchronization","status":403,"blocked":true,"rules":["920420"]},{"method":"POST","path":"/Synchronization","status":403,"blocked":true,"rules":["920420"]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"blocked","templateId":"CVE-2024-55956","templatePath":"http/cves/2024/CVE-2024-55956.yaml","requests":2,"blockedRequests":2,"rules":["920420","932240","941340","942131","942180","942430","942520"],"note":"","requestDetail":[{"method":"POST","path":"/Synchronization","status":403,"blocked":true,"rules":["920420","932240","941340","942180","942430"]},{"method":"POST","path":"/Synchronization","status":403,"blocked":true,"rules":["920420","932240","941340","942131","942180","942430"]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0}],"top_posts":[],"exploit_repositories":[]}}