Fortra GoAnywhere MFT Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 10/02/2023. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.
| Package | Affected versions | Patched versions |
|---|---|---|
| metasploit-framework | ≤ 6.0.33 | |
| goanywhere managed file transfer | < 7.1.2 | 7.1.2 |
This advisory has been withdrawn because it was incorrectly associated with the metasploit-framework package, which is not affected by this CVE, and the actual vulnerable component does not fit within our supported ecosystems. This link is maintained to preserve external references.
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free