CVE-2023-2991 - Fortra Globalscape Administration Server Information Disclosure

Back Back to CVE browser

MEDIUM

Fortra Globalscape Administration Server Information Disclosure

Published Jun 22, 2023

5.3

MEDIUM

CVSS 3.1

EPSS 0.64%

Description

Fortra Globalscape EFT's administration server suffers from an information disclosure vulnerability where the serial number of the harddrive that Globalscape is installed on can be remotely determined via a "trial extension request" message

Affected products

Vendor Fortra Product Globalscape EFT Default
unaffected
- Version
  8.0.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Fortra

Globalscape EFT

unaffected

Version	Status	Constraints
8.0.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (2)

https://kb.globalscape.com/Knowledgebase/11589/Is-EFT-susceptible-to-the-Remotely-obtain-HDD-serial-number-vulnerability
Vendor Advisory
https://www.rapid7.com/blog/post/2023/06/22/multiple-vulnerabilities-in-fortra-globalscape-eft-administration-server-fixed/
ExploitThird Party Advisory

Link	Providers	Tags
https://kb.globalscape.com/Knowledgebase/11589/Is-EFT-susceptible-to-the-Remotely-obtain-HDD-serial-number-vulnerability		Vendor Advisory
https://www.rapid7.com/blog/post/2023/06/22/multiple-vulnerabilities-in-fortra-globalscape-eft-administration-server-fixed/		ExploitThird Party Advisory