← CVE Radar
CVE-2023-0669Fortra GoAnywhere MFT License Response Servlet Command Injection
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
7.2 HIGHEPSS 99.99%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 7.2 | HIGH | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
CISA required action
⚡ Known exploited · remediation due Mar 3, 2023
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2023-0669
- Status
- Analyzed
- Assigner (CNA)
- rapid7
- Published
- Feb 6, 2023
- Last modified
- 2026-08-06 05:16 UTC
- Weaknesses
- CWE-502 · Deserialization of Untrusted Data
Affected Products
As published by the CNA in the CVE record.
FortraGoanywhere MFT1 version range
- through 7.1.1
References
- packetstormsecurity.com http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html
- attackerkb.com https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis
- duo.com https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft
- frycos.github.io https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html
- github.com https://github.com/rapid7/metasploit-framework/pull/17607
- infosec.exchange https://infosec.exchange/@briankrebs/109795710941843934
- my.goanywhere.com https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1
- rapid7.com https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-0669