{"id":"CVE-2024-11922","state":"PUBLISHED","title":"Input Validation vulnerability in Web Client emails that do not go through Secure Mail","description":"Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emails to insert arbitrary HTML or JavaScript into an email.","publishedAt":"2025-04-28T20:57:37.388Z","updatedAt":"2025-04-28T22:27:53.032Z","severity":{"score":6.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","source":"Fortra"},"assigner":"Fortra","products":["Fortra GoAnywhere MFT"],"affected":[{"vendor":"Fortra","product":"GoAnywhere MFT","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"7.7.1","versionType":"custom"}],"platforms":["Windows","Linux","64 bit","iSeries","IBM System P","IBM z (Mainframe)","UNIX"]}],"references":["https://www.fortra.com/security/advisories/product-security/fi-2025-005"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:06:50.777Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/11xxx/CVE-2024-11922.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-11922","state":"PUBLISHED","datePublished":"2025-04-28T20:57:37.388Z","dateUpdated":"2025-04-28T22:27:53.032Z","assignerShortName":"Fortra","assignerOrgId":"df4dee71-de3a-4139-9588-11b62fe6c0ff","dateReserved":"2024-11-27T18:20:19.664Z"},"containers":{"cna":{"title":"Input Validation vulnerability in Web Client emails that do not go through Secure Mail","descriptions":[{"lang":"en","value":"Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emails to insert arbitrary HTML or JavaScript into an email."}],"affected":[{"vendor":"Fortra","product":"GoAnywhere MFT","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"7.7.1","versionType":"custom"}],"platforms":["Windows","Linux","64 bit","iSeries","IBM System P","IBM z (Mainframe)","UNIX"]}],"references":[{"url":"https://www.fortra.com/security/advisories/product-security/fi-2025-005","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Fortra","orgId":"df4dee71-de3a-4139-9588-11b62fe6c0ff","dateUpdated":"2025-04-28T20:57:37.388Z"},"datePublic":"2025-04-22T18:09:00.000Z","impacts":[{"capecId":"CAPEC-63","descriptions":[{"lang":"en","value":"CAPEC-63 Cross-Site Scripting (XSS)"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Upgrade to version 7.8.0"}],"value":"Upgrade to version 7.8.0"}],"source":{"discovery":"EXTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: rgba(9, 30, 66, 0.055);\">Limit access to only trustworthy Web Users</span>\n\n<br>"}],"value":"Limit access to only trustworthy Web Users"}],"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-04-28T22:27:45.719964Z","id":"CVE-2024-11922","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-28T22:27:53.032Z"}}]}}}