Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.
The vulnerability is classified as CWE-425 (Direct Request / Forced Browsing) and involves the application failing to properly verify user identity before granting access to sensitive administrative portal functions. An unauthenticated attacker can directly invoke the appropriate resource in the administrative portal, bypassing the required login procedure. As a result, it is possible to invoke the function that creates a new user with administrator privileges.
Attackers gain full administrative control over the GoAnywhere MFT system, which may lead to unauthorized access to transmitted files, modification of system configuration, and further compromise of the organization's infrastructure.
Fortra GoAnywhere MFT must be immediately updated to version 7.4.1 or newer. Detailed information is available in the official Fortra security bulletin (FI-2024-001) at fortra.com/security/advisory/fi-2024-001.
Fortra GoAnywhere MFT versions prior to 7.4.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HFortra Goanywhere Managed File Transfer
APPFortra6.0.07.0.0 – 7.4.1 (bez)
Related vulnerabilities
Deserialization i command injection w Fortra GoAnywhere MFT (License Servlet)
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerabilit...
The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if the Web User...
Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2...
An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configure...