PT-2024-20790 · Helpsystems · Goanywhere Mft

Published 2024-08-14 · Updated 2024-08-19 · CVE-2024-25157

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GoAnywhere MFT versions prior to 7.6.0

Description An authentication bypass issue allows Admin Users with access to the Agent Console to circumvent some permission checks, potentially leading to unauthorized information disclosure or modification.

Recommendations For versions prior to 7.6.0, update to version 7.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Agent Console for Admin Users to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-303

Related Identifiers

CVE-2024-25157

Affected Products

Goanywhere Mft

References · 4

• https://osv.dev/vulnerability/CVE-2024-25157 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25157 · Security Note
• https://fortra.com/security/advisories/product-security/fi-2024-009 · Vendor Advisory
• https://twitter.com/CVEnew/status/1823744014992204265 · Twitter Post