CVE-2023-0669

highPriorität · handeln · 90OT-Risiko · kritischKEV · ausgenutztEPSS 1.000 · 100. PerzentilExploit · waffenfähigEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 7 exploits · waffenfähig

Likely / severe?

100.0% (100th) EPSS

CVSS 7.2 · high

Is it mine?

4 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

hinzugefügt 2023-02-10beheben bis 2023-03-03

erforderliche Maßnahme Apply updates per vendor instructions.

EPSS · bewertet 2026-10-26

Fortra GoAnywhere MFT Remote Code Execution Vulnerability

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.2

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.3–7.2

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 1.2 · Auswirkung 5.9

v3.16.3mediumAV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lsecondary · FSTEC (BDU) RU

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HsecondaryAusnutzbarkeit 1.2 · Auswirkung 5.9

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: active · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-502USprimärCWE-502USCWE-502US

ATT&CK-Techniken

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

Exploits (7)

Öffentlicher Proof-of-Concept- und Exploit-Code.

exploit/multi/http/fortra_goanywhere_rce_cve_2023_0669Fortra GoAnywhere MFT Unsafe Deserialization RCEwaffenfähig · metasploit
EDB-51339Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE)PoC · exploit_db
0xf4n9x/CVE-2023-0669CVE-2023-0669 GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object.PoC · poc_in_github
Avento/CVE-2023-0669GoAnywhere MFT CVE-2023-0669 LicenseResponseServlet Deserialization Vulnerabilities Python RCE PoC(Proof of Concept)PoC · poc_in_github
cataliniovita/CVE-2023-0669CVE-2023-0669 GoAnywhere MFT command injection vulnerabilityPoC · poc_in_github
yosef0x01/CVE-2023-0669-AnalysisCVE analysis for CVE-2023-0669PoC · poc_in_github

betroffene Produkte (4)

Betroffene Produkte und Versionsbereiche.

Fortra GoAnywhere MFT≤ 0 ≤7.1.1enisa_euvdEU
Fortra, LLC GoAnywhere MFT≤ 7.1.2fstec_bduRU
fortra goanywhere managed file transfer< 7.1.2nvdUScpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:*
RubyGems metasploit-framework≤ 6.0.33osvUSpkg:gem/metasploit-framework

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

GHSA-6pm2-j2v8-h3cjWithdrawn: Fortra GoAnywhere MFT Deserialization of Untrusted Data vulnerability affects metasploit-framework2023-02-06ghsa · osvUS
## Withdrawn This advisory has been withdrawn because it was incorrectly associated with the metasploit-framework package, which is not affected by this CVE, and the actual vulnerable component does not fit within our supported ecosystems. This link is maintained to preserve external references. ## Original Description Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu nvd osv NVD CVE.org MITRE

veröffentlicht 2023-02-06geändert 2026-08-24

verwandt (3,742)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-63077US	—OT kritisch	93.6% (100th)	KEV	2026-07-27
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
CVE-2026-58644US	—OT kritisch	15.9% (97th)	KEV	2026-07-14
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVE-2026-50522US	—OT kritisch	3.04% (87th)	KEV	2026-07-14
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVE-2026-12569US	critical9.8OT kritisch	46.0% (99th)	KEV	2026-06-18
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of u…
CVE-2026-45247US	—OT kritisch	26.2% (98th)	KEV	2026-05-26
Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code exec…

+3737 weitere

Referenzen (30)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan