Vulnerability · Published Apr 28, 2025 · Assigned by Fortra
CVE-2024-11922Input Validation vulnerability in Web Client emails that do not go through Secure Mail
Medium 6.3
In plain English
A medium-severity cross-site scripting in GoAnywhere MFT from Fortra. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.2%top 85.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emails to insert arbitrary HTML or JavaScript into an email.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortra | GoAnywhere MFT | 0 – through 7.7.1 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L