{"id":"CVE-2024-25157","state":"PUBLISHED","title":"Authentication bypass in GoAnywhere MFT prior to 7.6.0","description":"An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checks when attempting to visit other pages. This could lead to unauthorized information disclosure or modification.","publishedAt":"2024-08-14T15:04:10.987Z","updatedAt":"2024-08-29T03:55:30.276Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","source":"Fortra"},"assigner":"Fortra","products":["Fortra GoAnywhere MFT"],"affected":[{"vendor":"Fortra","product":"GoAnywhere MFT","defaultStatus":"affected","versions":[{"version":"6.0.1","status":"affected","lessThan":"7.6.0","versionType":"semver"}]}],"references":["https://www.fortra.com/security/advisories/product-security/fi-2024-009"],"weaknesses":["CWE-303"],"ingestedAt":"2026-10-29T20:07:10.607Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/25xxx/CVE-2024-25157.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-25157","state":"PUBLISHED","datePublished":"2024-08-14T15:04:10.987Z","dateUpdated":"2024-08-29T03:55:30.276Z","assignerShortName":"Fortra","assignerOrgId":"df4dee71-de3a-4139-9588-11b62fe6c0ff","dateReserved":"2024-02-06T21:23:57.925Z"},"containers":{"cna":{"title":"Authentication bypass in GoAnywhere MFT prior to 7.6.0","descriptions":[{"lang":"en","value":"An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checks when attempting to visit other pages. This could lead to unauthorized information disclosure or modification."}],"affected":[{"vendor":"Fortra","product":"GoAnywhere MFT","defaultStatus":"affected","versions":[{"version":"6.0.1","status":"affected","lessThan":"7.6.0","versionType":"semver"}]}],"references":[{"url":"https://www.fortra.com/security/advisories/product-security/fi-2024-009"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-303","description":"CWE-303: Incorrect Implementation of Authentication Algorithm","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Fortra","orgId":"df4dee71-de3a-4139-9588-11b62fe6c0ff","dateUpdated":"2024-08-14T15:04:10.987Z"},"impacts":[{"capecId":"CAPEC-114","descriptions":[{"lang":"en","value":"CAPEC-114 Authentication Abuse"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Upgrade to GoAnywhere MFT 7.6.0<br>"}],"value":"Upgrade to GoAnywhere MFT 7.6.0"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"fortra","product":"goanywhere_managed_file_transfer","defaultStatus":"unknown","versions":[{"version":"6.0.1","status":"affected","lessThan":"7.6.0","versionType":"semver"}],"cpes":["cpe:2.3:a:fortra:goanywhere_managed_file_transfer:-:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-28T00:00:00+00:00","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3","id":"CVE-2024-25157"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-29T03:55:30.276Z"}}]}}}