Known Vulnerabilities
CVE-2024-25157
An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checks when attempting to visit other pages. This could lead to unauthorized information disclosure or modification.
MEDIUM
CVSS 6.5
Published Aug 14, 2024
CVE-2024-25156
A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywhere Admin and Web Clients.
MEDIUM
CVSS 6.5
Published Mar 14, 2024
CVE-2024-0204
Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.
CRITICAL
CVSS 9.8
Published Jan 22, 2024