Paper/Archive/CVE-2024-0204

CVE-2024-0204

Fortra GoAnywhere MFT — Authentication Bypass in GoAnywhere MFT

EPSS 95%CVSS 9.8

critical.is priorityof 100

49

CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 99.9.999 × 2020.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.

Affected

ProductAffectedFixed inSource

GoAnywhere MFT6.0.1 – < 7.4.17.4.1CNA

Scores by source

Fortra (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisoryfortra.com/security/advisory/fi-2024-001 refmy.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml refpacketstormsecurity.com/files/176683/GoAnywhere-MFT-Authentication-Bypass.html refpacketstormsecurity.com/files/176974/Fortra-GoAnywhere-MFT-Unauthenticated-Remote-Code-Execution.html