Vulnerability CVE-2023-0669
Published: 2023-02-06

Description:
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object.

See advisories in our WLB2 database:
Topic
Author
Date
Low
Fortra GoAnywhere MFT Unsafe Deserialization Remote Code Execution
Ron Bowes
09.02.2023
High
Goanywhere Encryption Helper 7.1.1 Remote Code Execution
Youssef Muhammad
10.04.2023

 References:
https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1
https://infosec.exchange/@briankrebs/109795710941843934
https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/
Copyright 2024, cxsecurity.com

 

Back to Top