CVE-2024-0204

high-risk

Published 2024-01-22

Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.

Do I need to act?

93.0% chance of exploitation in next 30 days

EPSS score — higher than 7% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

1 public exploit available

52308

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Goanywhere Managed File Transfer

Fortra

Third Party Advisory http://packetstormsecurity.com/files/176683/GoAnywhere-MFT-Authentication-Bypass...

Permissions Required https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml

Vendor Advisory https://www.fortra.com/security/advisory/fi-2024-001

Third Party Advisory http://packetstormsecurity.com/files/176683/GoAnywhere-MFT-Authentication-Bypass...

Permissions Required https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml

Vendor Advisory https://www.fortra.com/security/advisory/fi-2024-001

/ 100

high-risk

Severity 32/34 · Critical

Exploitability 20/34 · Moderate

Exposure 7/34 · Low