CVE-2023-0669

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object.

Recent assessments:

rbowes-r7 at February 06, 2023 8:59pm UTC reported:

This is currently unpatched and vulnerable in the default state. The time from reading the mitigation to having a working exploit was less than day, and that’s for somebody who isn’t super good at Java vulnerabilities.

cbeek-r7 at October 16, 2023 12:28pm UTC reported:

This is currently unpatched and vulnerable in the default state. The time from reading the mitigation to having a working exploit was less than day, and that’s for somebody who isn’t super good at Java vulnerabilities.

Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 5