CVE-2024-25157CWE-303

Authentication bypass in GoAnywhere MFT prior to 7.6.0

Medium · published August 14, 2024

CVSS v3.1
6.5
EPSS
0%
Percentile
41.8
In the wild
Unconfirmed
What it is

An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checks when attempting to visit other pages. This could lead to unauthorized information disclosure or modification.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00498 · 41.8th percentile
Weakness
CWE-303 · Incorrect Implementation of Authentication Algorithm
Published
2024-08-14T15:04Z
EPSS history
Timeline
  • 14 AUG 15:04Z
    Authentication bypass in GoAnywhere MFT prior to 7.6.0
    cvelistv5