VulnerabilityAnalyzed

CVE-2024-25157

An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checks when attempting to visit other pages.

MEDIUM 6.5EPSS 0.50%

Does this matter?

Lower severity and a low EPSS score (0.50%). Track it; it rarely justifies an emergency change on its own.

Description

An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checks when attempting to visit other pages. This could lead to unauthorized information disclosure or modification.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
EPSS: 0.50% probability · 41th percentile
CISA KEV: Not listed
Weakness: CWE-303, CWE-287
Affected: fortra/goanywhere managed file transfer
Source: df4dee71-de3a-4139-9588-11b62fe6c0ff

References

https://www.fortra.com/security/advisories/product-security/fi-2024-009Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.