Withdrawn: Fortra GoAnywhere MFT Deserialization of Untrusted Data vulnerability affects metasploit-framework
## Withdrawn This advisory has been withdrawn because it was incorrectly associated with the metasploit-framework package, which is not affected by this CVE, and the actual vulnerable component does not fit within our supported ecosystems. This link is maintained to preserve external references. ## Original Description Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-0669US | high7.2OT critical | KEV | ||
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary at… | ||||
references
External citations — patches, advisories, analysis.
- http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.htmlWEB
- https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysisWEB
- https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mftWEB
- https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.htmlWEB
- https://github.com/rapid7/metasploit-frameworkPACKAGE
- https://github.com/rapid7/metasploit-framework/pull/17607WEB
- https://infosec.exchange/@briankrebs/109795710941843934WEB
- https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1WEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan