cvelistv5 - CVE-2023-0669

CVE-2023-0669 (GCVE-0-2023-0669)

Vulnerability from cvelistv5 – Published: 2023-02-06 19:16 – Updated: 2025-10-21 23:15

CISA

Summary

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

Severity ?

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

rapid7

References

URL

	Vendor	Product	Version
	Fortra	Goanywhere MFT	Affected: 0 , ≤ 7.1.1 (semver)

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

Date added: 2023-02-10

Due date: 2023-03-03

Required action: Apply updates per vendor instructions.

Used in ransomware: Known

Notes: This CVE has a CISA AA located here: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a. Please see the AA for associated IOCs. Additional information is available at: https://my.goanywhere.com/webclient/DownloadProductFiles.xhtml. Fortra users must have an account in order to login and access the patch.; https://nvd.nist.gov/vuln/detail/CVE-2023-0669

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:17:50.355Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1"
          },
          {
            "tags": [
              "media-coverage",
              "x_transferred"
            ],
            "url": "https://infosec.exchange/@briankrebs/109795710941843934"
          },
          {
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/"
          },
          {
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis"
          },
          {
            "tags": [
              "exploit",
              "x_transferred"
            ],
            "url": "https://github.com/rapid7/metasploit-framework/pull/17607"
          },
          {
            "tags": [
              "media-coverage",
              "x_transferred"
            ],
            "url": "https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft"
          },
          {
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-0669",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2023-12-09T05:05:06.460030Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2023-02-10",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-0669"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:15:27.683Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-0669"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2023-02-10T00:00:00+00:00",
            "value": "CVE-2023-0669 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Goanywhere MFT",
          "vendor": "Fortra",
          "versions": [
            {
              "lessThanOrEqual": "7.1.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "other",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Brian Krebs of Krebs on Security"
        },
        {
          "lang": "en",
          "type": "analyst",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Ron Bowes of Rapid7"
        },
        {
          "lang": "en",
          "type": "analyst",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Caitlin Condon of Rapid7"
        },
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Fryco of Frycos Security"
        }
      ],
      "datePublic": "2023-02-01T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2."
            }
          ],
          "value": "Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-10T19:06:33.125Z",
        "orgId": "9974b330-7714-4307-a722-5648477acda7",
        "shortName": "rapid7"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1"
        },
        {
          "tags": [
            "media-coverage"
          ],
          "url": "https://infosec.exchange/@briankrebs/109795710941843934"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/rapid7/metasploit-framework/pull/17607"
        },
        {
          "tags": [
            "media-coverage"
          ],
          "url": "https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html"
        },
        {
          "url": "http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Fortra GoAnywhere MFT License Response Servlet Command Injection",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7",
    "assignerShortName": "rapid7",
    "cveId": "CVE-2023-0669",
    "datePublished": "2023-02-06T19:16:19.265Z",
    "dateReserved": "2023-02-03T22:09:23.898Z",
    "dateUpdated": "2025-10-21T23:15:27.683Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2023-0669",
      "cwes": "[\"CWE-502\"]",
      "dateAdded": "2023-02-10",
      "dueDate": "2023-03-03",
      "knownRansomwareCampaignUse": "Known",
      "notes": "This CVE has a CISA AA located here: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a. Please see the AA for associated IOCs. Additional information is available at: https://my.goanywhere.com/webclient/DownloadProductFiles.xhtml. Fortra users must have an account in order to login and access the patch.;  https://nvd.nist.gov/vuln/detail/CVE-2023-0669",
      "product": "GoAnywhere MFT",
      "requiredAction": "Apply updates per vendor instructions.",
      "shortDescription": "Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.",
      "vendorProject": "Fortra",
      "vulnerabilityName": "Fortra GoAnywhere MFT Remote Code Execution Vulnerability"
    },
    "fkie_nvd": {
      "cisaActionDue": "2023-03-03",
      "cisaExploitAdd": "2023-02-10",
      "cisaRequiredAction": "Apply updates per vendor instructions.",
      "cisaVulnerabilityName": "Fortra GoAnywhere MFT Remote Code Execution Vulnerability",
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"7.1.2\", \"matchCriteriaId\": \"F2CDAD23-E5EA-4830-9D57-5E6BC0E85244\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.\"}]",
      "id": "CVE-2023-0669",
      "lastModified": "2024-11-21T07:37:35.710",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.2, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.2, \"impactScore\": 5.9}]}",
      "published": "2023-02-06T20:15:14.300",
      "references": "[{\"url\": \"http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html\", \"source\": \"cve@rapid7.com\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis\", \"source\": \"cve@rapid7.com\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft\", \"source\": \"cve@rapid7.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html\", \"source\": \"cve@rapid7.com\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/rapid7/metasploit-framework/pull/17607\", \"source\": \"cve@rapid7.com\", \"tags\": [\"Patch\"]}, {\"url\": \"https://infosec.exchange/@briankrebs/109795710941843934\", \"source\": \"cve@rapid7.com\", \"tags\": [\"Mitigation\", \"Third Party Advisory\"]}, {\"url\": \"https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1\", \"source\": \"cve@rapid7.com\", \"tags\": [\"Product\"]}, {\"url\": \"https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/\", \"source\": \"cve@rapid7.com\", \"tags\": [\"Mitigation\", \"Third Party Advisory\"]}, {\"url\": \"http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/rapid7/metasploit-framework/pull/17607\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://infosec.exchange/@briankrebs/109795710941843934\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mitigation\", \"Third Party Advisory\"]}, {\"url\": \"https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Product\"]}, {\"url\": \"https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mitigation\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "cve@rapid7.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"cve@rapid7.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-502\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-502\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-0669\",\"sourceIdentifier\":\"cve@rapid7.com\",\"published\":\"2023-02-06T20:15:14.300\",\"lastModified\":\"2025-11-03T15:06:12.700\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.\"},{\"lang\":\"es\",\"value\":\"Fortra (anteriormente HelpSystems) GoAnywhere MFT presenta una vulnerabilidad de inyecci\u00f3n de comandos de preautenticaci\u00f3n en el servlet de respuesta a licencias debido a la deserializaci\u00f3n de un objeto arbitrario controlado por un atacante. Este problema se solucion\u00f3 en la versi\u00f3n 7.1.2.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}]},\"cisaExploitAdd\":\"2023-02-10\",\"cisaActionDue\":\"2023-03-03\",\"cisaRequiredAction\":\"Apply updates per vendor instructions.\",\"cisaVulnerabilityName\":\"Fortra GoAnywhere MFT Remote Code Execution Vulnerability\",\"weaknesses\":[{\"source\":\"cve@rapid7.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"7.1.2\",\"matchCriteriaId\":\"F2CDAD23-E5EA-4830-9D57-5E6BC0E85244\"}]}]}],\"references\":[{\"url\":\"http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html\",\"source\":\"cve@rapid7.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis\",\"source\":\"cve@rapid7.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft\",\"source\":\"cve@rapid7.com\",\"tags\":[\"Broken Link\",\"Third Party Advisory\"]},{\"url\":\"https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html\",\"source\":\"cve@rapid7.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/rapid7/metasploit-framework/pull/17607\",\"source\":\"cve@rapid7.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://infosec.exchange/@briankrebs/109795710941843934\",\"source\":\"cve@rapid7.com\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1\",\"source\":\"cve@rapid7.com\",\"tags\":[\"Product\"]},{\"url\":\"https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/\",\"source\":\"cve@rapid7.com\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Third Party Advisory\"]},{\"url\":\"https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/rapid7/metasploit-framework/pull/17607\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://infosec.exchange/@briankrebs/109795710941843934\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Product\"]},{\"url\":\"https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-0669\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"US Government Resource\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"product\": \"Goanywhere MFT\", \"vendor\": \"Fortra\", \"versions\": [{\"lessThanOrEqual\": \"7.1.1\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\"}]}], \"credits\": [{\"lang\": \"en\", \"type\": \"other\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Brian Krebs of Krebs on Security\"}, {\"lang\": \"en\", \"type\": \"analyst\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Ron Bowes of Rapid7\"}, {\"lang\": \"en\", \"type\": \"analyst\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Caitlin Condon of Rapid7\"}, {\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Fryco of Frycos Security\"}], \"datePublic\": \"2023-02-01T15:00:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.\"}], \"value\": \"Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.\"}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-502\", \"description\": \"CWE-502 Deserialization of Untrusted Data\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"orgId\": \"9974b330-7714-4307-a722-5648477acda7\", \"shortName\": \"rapid7\", \"dateUpdated\": \"2023-04-10T19:06:33.125Z\"}, \"references\": [{\"tags\": [\"vendor-advisory\"], \"url\": \"https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1\"}, {\"tags\": [\"media-coverage\"], \"url\": \"https://infosec.exchange/@briankrebs/109795710941843934\"}, {\"tags\": [\"third-party-advisory\"], \"url\": \"https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/\"}, {\"tags\": [\"third-party-advisory\"], \"url\": \"https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis\"}, {\"tags\": [\"exploit\"], \"url\": \"https://github.com/rapid7/metasploit-framework/pull/17607\"}, {\"tags\": [\"media-coverage\"], \"url\": \"https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft\"}, {\"tags\": [\"third-party-advisory\"], \"url\": \"https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html\"}, {\"url\": \"http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html\"}], \"source\": {\"discovery\": \"UNKNOWN\"}, \"title\": \"Fortra GoAnywhere MFT License Response Servlet Command Injection\", \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T05:17:50.355Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"tags\": [\"vendor-advisory\", \"x_transferred\"], \"url\": \"https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1\"}, {\"tags\": [\"media-coverage\", \"x_transferred\"], \"url\": \"https://infosec.exchange/@briankrebs/109795710941843934\"}, {\"tags\": [\"third-party-advisory\", \"x_transferred\"], \"url\": \"https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/\"}, {\"tags\": [\"third-party-advisory\", \"x_transferred\"], \"url\": \"https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis\"}, {\"tags\": [\"exploit\", \"x_transferred\"], \"url\": \"https://github.com/rapid7/metasploit-framework/pull/17607\"}, {\"tags\": [\"media-coverage\", \"x_transferred\"], \"url\": \"https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft\"}, {\"tags\": [\"third-party-advisory\", \"x_transferred\"], \"url\": \"https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html\"}, {\"url\": \"http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html\", \"tags\": [\"x_transferred\"]}]}, {\"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-0669\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2023-12-09T05:05:06.460030Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2023-02-10\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-0669\"}}}], \"references\": [{\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-0669\", \"tags\": [\"government-resource\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-04T14:09:49.104Z\"}, \"timeline\": [{\"time\": \"2023-02-10T00:00:00+00:00\", \"lang\": \"en\", \"value\": \"CVE-2023-0669 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-0669\", \"assignerOrgId\": \"9974b330-7714-4307-a722-5648477acda7\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"rapid7\", \"dateReserved\": \"2023-02-03T22:09:23.898Z\", \"datePublished\": \"2023-02-06T19:16:19.265Z\", \"dateUpdated\": \"2025-10-21T19:45:51.333Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GSD-2023-0669

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Aliases

CVE-2023-0669

Aliases

CVE-2023-0669

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-0669",
    "id": "GSD-2023-0669"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-0669"
      ],
      "details": "Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.",
      "id": "GSD-2023-0669",
      "modified": "2023-12-13T01:20:22.872454Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@rapid7.com",
        "ID": "CVE-2023-0669",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Goanywhere MFT",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "0",
                          "version_value": "7.1.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Fortra"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "Brian Krebs of Krebs on Security"
        },
        {
          "lang": "en",
          "value": "Ron Bowes of Rapid7"
        },
        {
          "lang": "en",
          "value": "Caitlin Condon of Rapid7"
        },
        {
          "lang": "en",
          "value": "Fryco of Frycos Security"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2."
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-502",
                "lang": "eng",
                "value": "CWE-502 Deserialization of Untrusted Data"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1",
            "refsource": "MISC",
            "url": "https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1"
          },
          {
            "name": "https://infosec.exchange/@briankrebs/109795710941843934",
            "refsource": "MISC",
            "url": "https://infosec.exchange/@briankrebs/109795710941843934"
          },
          {
            "name": "https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/",
            "refsource": "MISC",
            "url": "https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/"
          },
          {
            "name": "https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis",
            "refsource": "MISC",
            "url": "https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis"
          },
          {
            "name": "https://github.com/rapid7/metasploit-framework/pull/17607",
            "refsource": "MISC",
            "url": "https://github.com/rapid7/metasploit-framework/pull/17607"
          },
          {
            "name": "https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft",
            "refsource": "MISC",
            "url": "https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft"
          },
          {
            "name": "https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html",
            "refsource": "MISC",
            "url": "https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html"
          },
          {
            "name": "http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html",
            "refsource": "MISC",
            "url": "http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html"
          }
        ]
      },
      "source": {
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "7.1.2",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@rapid7.com",
          "ID": "CVE-2023-0669"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-502"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1",
              "refsource": "MISC",
              "tags": [
                "Product"
              ],
              "url": "https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1"
            },
            {
              "name": "https://infosec.exchange/@briankrebs/109795710941843934",
              "refsource": "MISC",
              "tags": [
                "Mitigation",
                "Third Party Advisory"
              ],
              "url": "https://infosec.exchange/@briankrebs/109795710941843934"
            },
            {
              "name": "https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/",
              "refsource": "MISC",
              "tags": [
                "Mitigation",
                "Third Party Advisory"
              ],
              "url": "https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/"
            },
            {
              "name": "https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis"
            },
            {
              "name": "https://github.com/rapid7/metasploit-framework/pull/17607",
              "refsource": "MISC",
              "tags": [
                "Patch"
              ],
              "url": "https://github.com/rapid7/metasploit-framework/pull/17607"
            },
            {
              "name": "https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft"
            },
            {
              "name": "https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html"
            },
            {
              "name": "http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html",
              "refsource": "MISC",
              "tags": [],
              "url": "http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.2,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-04-10T20:15Z",
      "publishedDate": "2023-02-06T20:15Z"
    }
  }
}

FKIE_CVE-2023-0669

Vulnerability from fkie_nvd - Published: 2023-02-06 20:15 - Updated: 2025-11-03 15:06

Severity ?

7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
cve@rapid7.com	http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html	Exploit, Third Party Advisory, VDB Entry
cve@rapid7.com	https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis	Exploit, Third Party Advisory
cve@rapid7.com	https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft	Broken Link, Third Party Advisory
cve@rapid7.com	https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html	Exploit, Third Party Advisory
cve@rapid7.com	https://github.com/rapid7/metasploit-framework/pull/17607	Patch
cve@rapid7.com	https://infosec.exchange/@briankrebs/109795710941843934	Mitigation, Third Party Advisory
cve@rapid7.com	https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1	Product
cve@rapid7.com	https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/	Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html	Exploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft	Broken Link, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/rapid7/metasploit-framework/pull/17607	Patch
af854a3a-2127-422b-91ae-364da2661108	https://infosec.exchange/@briankrebs/109795710941843934	Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1	Product
af854a3a-2127-422b-91ae-364da2661108	https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/	Mitigation, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-0669	US Government Resource

Impacted products

	Vendor	Product	Version
	fortra	goanywhere_managed_file_transfer	*

JSON

To clipboard

{
  "cisaActionDue": "2023-03-03",
  "cisaExploitAdd": "2023-02-10",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "Fortra GoAnywhere MFT Remote Code Execution Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F2CDAD23-E5EA-4830-9D57-5E6BC0E85244",
              "versionEndExcluding": "7.1.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2."
    },
    {
      "lang": "es",
      "value": "Fortra (anteriormente HelpSystems) GoAnywhere MFT presenta una vulnerabilidad de inyecci\u00f3n de comandos de preautenticaci\u00f3n en el servlet de respuesta a licencias debido a la deserializaci\u00f3n de un objeto arbitrario controlado por un atacante. Este problema se solucion\u00f3 en la versi\u00f3n 7.1.2."
    }
  ],
  "id": "CVE-2023-0669",
  "lastModified": "2025-11-03T15:06:12.700",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2023-02-06T20:15:14.300",
  "references": [
    {
      "source": "cve@rapid7.com",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html"
    },
    {
      "source": "cve@rapid7.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis"
    },
    {
      "source": "cve@rapid7.com",
      "tags": [
        "Broken Link",
        "Third Party Advisory"
      ],
      "url": "https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft"
    },
    {
      "source": "cve@rapid7.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html"
    },
    {
      "source": "cve@rapid7.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/rapid7/metasploit-framework/pull/17607"
    },
    {
      "source": "cve@rapid7.com",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://infosec.exchange/@briankrebs/109795710941843934"
    },
    {
      "source": "cve@rapid7.com",
      "tags": [
        "Product"
      ],
      "url": "https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1"
    },
    {
      "source": "cve@rapid7.com",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link",
        "Third Party Advisory"
      ],
      "url": "https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/rapid7/metasploit-framework/pull/17607"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://infosec.exchange/@briankrebs/109795710941843934"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product"
      ],
      "url": "https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-0669"
    }
  ],
  "sourceIdentifier": "cve@rapid7.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "cve@rapid7.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-6PM2-J2V8-H3CJ

Vulnerability from github – Published: 2023-02-06 21:30 – Updated: 2025-07-30 11:45

Summary

Withdrawn: Fortra GoAnywhere MFT Deserialization of Untrusted Data vulnerability affects metasploit-framework

Details

Withdrawn

This advisory has been withdrawn because it was incorrectly associated with the metasploit-framework package, which is not affected by this CVE, and the actual vulnerable component does not fit within our supported ecosystems. This link is maintained to preserve external references.

Original Description

Severity ?

7.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "metasploit-framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "6.0.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-0669"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-08T22:39:43Z",
    "nvd_published_at": "2023-02-06T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "## Withdrawn\nThis advisory has been withdrawn because it was incorrectly associated with the metasploit-framework package, which is not affected by this CVE, and the actual vulnerable component does not fit within our supported ecosystems. This link is maintained to preserve external references.\n\n## Original Description\n\nFortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object.",
  "id": "GHSA-6pm2-j2v8-h3cj",
  "modified": "2025-07-30T11:45:23Z",
  "published": "2023-02-06T21:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0669"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rapid7/metasploit-framework/pull/17607"
    },
    {
      "type": "WEB",
      "url": "https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis"
    },
    {
      "type": "WEB",
      "url": "https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft"
    },
    {
      "type": "WEB",
      "url": "https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rapid7/metasploit-framework"
    },
    {
      "type": "WEB",
      "url": "https://infosec.exchange/@briankrebs/109795710941843934"
    },
    {
      "type": "WEB",
      "url": "https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1"
    },
    {
      "type": "WEB",
      "url": "https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Withdrawn: Fortra GoAnywhere MFT Deserialization of Untrusted Data vulnerability affects metasploit-framework",
  "withdrawn": "2023-02-09T22:03:51Z"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2023-0669 (GCVE-0-2023-0669)

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

GSD-2023-0669

FKIE_CVE-2023-0669

GHSA-6PM2-J2V8-H3CJ

Withdrawn

Original Description

Tags

Sightings

Nomenclature