CVE-2024-9945 - Limited Information Disclosure in GoAnywhere MFT Prior to 7.7.0

Back Back to CVE browser

MEDIUM

Limited Information Disclosure in GoAnywhere MFT Prior to 7.7.0

Published Dec 13, 2024

5.3

MEDIUM

CVSS 3.1

EPSS 0.32%

Description

An information-disclosure vulnerability exists in Fortra's GoAnywhere MFT application prior to version 7.7.0 that allows external access to the resources in certain admin root folders.

Affected products

Vendor Fortra Product GoAnywhere MFT Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <7.7.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Fortra

GoAnywhere MFT

unaffected

Version	Status	Constraints
0	affected	<7.7.0

Remediation

Vendor solution

Upgrade to GoAnywhere 7.7.0 or higher.

Weaknesses (3)

CWE-200

Exposure of Sensitive Information

CWE-425

CWE-552

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-50408
Advisory
https://www.fortra.com/security/advisories/product-security/fi-2024-014
vendor-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-50408		Advisory
https://www.fortra.com/security/advisories/product-security/fi-2024-014		vendor-advisory