Withdrawn: Fortra GoAnywhere MFT Deserialization of Untrusted Data vulnerability affects metasploit-framework
## Withdrawn This advisory has been withdrawn because it was incorrectly associated with the metasploit-framework package, which is not affected by this CVE, and the actual vulnerable component does not fit within our supported ecosystems. This link is maintained to preserve external references. ## Original Description Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-0669US | high7.2OT kritisch | KEV | ||
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary at… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.htmlWEB
- https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysisWEB
- https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mftWEB
- https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.htmlWEB
- https://github.com/rapid7/metasploit-frameworkPACKAGE
- https://github.com/rapid7/metasploit-framework/pull/17607WEB
- https://infosec.exchange/@briankrebs/109795710941843934WEB
- https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1WEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan