critical9.8Public exploit code
CVE-2024-0204
Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Fortra GoAnywhere MFT 7.4.1 - Authentication Bypass2025-05-29 · remote · multiple
Impact
Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fortra | Goanywhere Managed File Transfer | from 7.0.0 before 7.4.1 Version 6.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/176683/GoAnywhere-MFT-Authentication-Bypass.html
- http://packetstormsecurity.com/files/176974/Fortra-GoAnywhere-MFT-Unauthenticated-Remote-Code-Execution.html
- https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml
- https://www.fortra.com/security/advisory/fi-2024-001
- http://packetstormsecurity.com/files/176683/GoAnywhere-MFT-Authentication-Bypass.html
- http://packetstormsecurity.com/files/176974/Fortra-GoAnywhere-MFT-Unauthenticated-Remote-Code-Execution.html
- https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml
- https://www.fortra.com/security/advisory/fi-2024-001