CVE-2023-0669

Scores

EPSS Score

0.9436

CVSS

3.x 7.2

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

All CVSS Scores

CVSS 4.0

0.0

CVSS 3.x

7.2

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0

0.0

Description

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

Sources

nvd

CWEs

CWE-502

Related Vulnerabilities

BDU:2023-00833

Exploits

Exploit ID: CVE-2023-0669

Source: cisa

URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit ID: 51339

Source: exploitdb

URL: https://www.exploit-db.com/exploits/51339

Reference Links

http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html

https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis

https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft

https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html

https://github.com/rapid7/metasploit-framework/pull/17607

https://infosec.exchange/

briankrebs/109795710941843934

https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1

https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/

Vulnerable Software

Type: Configuration

Vendor: fortra

Product: goanywhere_managed_file_transfer

Operating System: * * *

Trait:

{
  "cpe_match": [
    {
      "cpe23uri": "cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:*",
      "versionEndExcluding": "7.1.2",
      "vulnerable": true
    }
  ],
  "operator": "OR"
}

Source: nvd