Vulnerability Description
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fortra | Goanywhere Managed File Transfer | < 7.1.2 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-RExploitThird Party AdvisoryVDB Entry
- https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysisExploitThird Party Advisory
- https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywherBroken LinkThird Party Advisory
- https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.htmlExploitThird Party Advisory
- https://github.com/rapid7/metasploit-framework/pull/17607Patch
- https://infosec.exchange/@briankrebs/109795710941843934MitigationThird Party Advisory
- https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1Product
- https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-MitigationThird Party Advisory
- http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-RExploitThird Party AdvisoryVDB Entry
- https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysisExploitThird Party Advisory
- https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywherBroken LinkThird Party Advisory
- https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.htmlExploitThird Party Advisory
- https://github.com/rapid7/metasploit-framework/pull/17607Patch
- https://infosec.exchange/@briankrebs/109795710941843934MitigationThird Party Advisory
- https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1Product
FAQ
What is CVE-2023-0669?
CVE-2023-0669 is a vulnerability with a CVSS score of 7.2 (HIGH). Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled ob...
How severe is CVE-2023-0669?
CVE-2023-0669 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-0669?
Check the references section above for vendor advisories and patch information. Affected products include: Fortra Goanywhere Managed File Transfer.