CVE-2024-0204

Name of the Vulnerable Software and Affected Versions Fortra GoAnywhere MFT versions prior to 7.4.1

Description An authentication bypass exists that allows an unauthorized remote user to create a new administrator account through the administration portal. This issue is caused by a path traversal weakness at the /InitialAccountSetup.xhtml endpoint. Approximately 35,407 devices worldwide are potentially affected.

Recommendations Update to version 7.4.1. For non-containerized deployments, delete the InitialAccountSetup.xhtml file in the installation directory and restart the services. For containerized deployments, replace the InitialAccountSetup.xhtml file with an empty file and restart the services.