by Kastro
Paper/Archive/CVE-2023-2989

CVE-2023-2989

Fortra Globalscape EFT — Fortra Globalscape Administration Server Out of Bounds Memory Read

EPSS 1.0%public exploitCVSS 9.1
critical.is priorityof 100
50
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 61.8.618 × 2012.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Fortra Globalscape EFT versions before 8.1.0.16 suffer from an out of bounds memory read in their administration server, which can allow an attacker to crash the service or bypass authentication if successfully exploited

Affected

ProductAffectedFixed inSource
Globalscape EFT8.0.0 – < 8.1.0.168.1.0.16CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refrapid7.com/blog/post/2023/06/22/multiple-vulnerabilities-in-fortra-globalscape-eft-administration-server-fixedrefkb.globalscape.com/Knowledgebase/11586/Is-EFT-susceptible-to-the-Authentication-Bypass-via-Outofbounds-Memory-Read-vulnerability