Vulnerability · Published Jan 22, 2024 · Assigned by Fortra
CVE-2024-0204Authentication Bypass in GoAnywhere MFT
Critical 9.8
In plain English
A critical-severity security flaw in GoAnywhere MFT from Fortra. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 95.1% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)95.1%top 0.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling3Metasploit, Nuclei, Public PoC
Official description
Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortra | GoAnywhere MFT | 6.0.1 – before 7.4.1 |
Weakness: CWE-425 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.fortra.com/security/advisory/fi-2024-001 vendor-advisory
- https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml permissions-required
- http://packetstormsecurity.com/files/176683/GoAnywhere-MFT-Authentication-Bypass.html
- http://packetstormsecurity.com/files/176974/Fortra-GoAnywhere-MFT-Unauthenticated-Remote-Code-Execution.html