CVE-2025-0049CWE-209

Disclosure of sensitive information in an error message in GoAnywhere prior to version 7.8.0

Low · published April 28, 2025

CVSS v3.1
3.5
EPSS
0%
Percentile
17.9
In the wild
Unconfirmed
What it is

When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for application mapping.

This issue affects GoAnywhere: before 7.8.0.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00268 · 17.9th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2025-04-28T20:55Z
EPSS history
Timeline
  • 28 APR 20:55Z
    Disclosure of sensitive information in an error message in GoAnywhere prior to version 7.8.0
    cvelistv5