CVE-2024-0204

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-425

Affected software

Vendor	Product	Versions
Fortra	GoAnywhere MFT	>= 6.0.1, < 7.4.1

References

http://packetstormsecurity.com/files/176683/GoAnywhere-MFT-Authentication-Bypass.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/176974/Fortra-GoAnywhere-MFT-Unauthenticated-Remote-Code-Execution.html
https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtmlPermissions Required
https://www.fortra.com/security/advisory/fi-2024-001Vendor Advisory
http://packetstormsecurity.com/files/176683/GoAnywhere-MFT-Authentication-Bypass.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/176974/Fortra-GoAnywhere-MFT-Unauthenticated-Remote-Code-Execution.html
https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtmlPermissions Required
https://www.fortra.com/security/advisory/fi-2024-001Vendor Advisory

Timeline

Published: Jan 22, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-02067.8A symbolic link manipulation vulnerability in Trellix Anti-Malware Engine prior to the January 2024 release allows an authenticated local us CVE-2024-02077.5HTTP3 dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file CVE-2024-02087.5GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted captu CVE-2024-02097.5IEEE 1609.2 dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafte CVE-2024-02107.5Zigbee TLV dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file CVE-2024-02117.5DOCSIS dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file CVE-2024-02126.5The Cloudflare Wordpress plugin was found to be vulnerable to improper authentication. The vulnerability enables attackers with a lower priv CVE-2024-02137.8A buffer overflow vulnerability in TA for Linux and TA for MacOS prior to 5.8.1 allows a local user to gain elevated permissions, or cause a CVE-2024-02166.4The Google Doc Embedder plugin for WordPress is vulnerable to Server Side Request Forgery via the 'gview' shortcode in versions up to, and i CVE-2024-02173.3A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a CVE-2024-02187.5A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian, caused by improper input validation in certain fields used in the Radiu CVE-2024-02197.8In Telerik JustDecompile versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer co