CVE-2024-9945CWE-200CWE-425CWE-552

Limited Information Disclosure in GoAnywhere MFT Prior to 7.7.0

Medium · published December 13, 2024

CVSS v3.1
5.3
EPSS
0%
Percentile
23.3
In the wild
Unconfirmed
What it is

An information-disclosure vulnerability exists in Fortra's GoAnywhere MFT application prior to version 7.7.0 that allows external access to the resources in certain admin root folders.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00316 · 23.3th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-425 · Direct Request ('Forced Browsing'); CWE-552 · Files or Directories Accessible to External Parties
Published
2024-12-13T15:22Z
EPSS history
Timeline
  • 13 DEC 15:22Z
    Limited Information Disclosure in GoAnywhere MFT Prior to 7.7.0
    cvelistv5