CVE-2024-11922: falha de média gravidade em Fortra GoAnywhere MFT
Input Validation vulnerability in Web Client emails that do not go through Secure Mail
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.3epss 0.2%
Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emails to insert arbitrary HTML or JavaScript into an email.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
Fortra · GoAnywhere MFTCVEs relacionadas — Fortra GoAnywhere MFT
No mesmo produto, das mais perigosas para as menos.
CVE-2025-10035CRITICALDeserialization Vulnerability in GoAnywhere MFT's License ServletEPSS 99.8%KEVCVE-2024-0204CRITICALAuthentication Bypass in GoAnywhere MFTEPSS 95.1%CVE-2024-25157MEDIUMAuthentication bypass in GoAnywhere MFT prior to 7.6.0EPSS 0.5%CVE-2026-15913HIGHPath Traversal in Fortra's GoAnywhere MFT EndpointEPSS 0.4%CVE-2024-25156MEDIUMPath traversal in GoAnywhere MFT 7.4.1 and EarlierEPSS 0.4%CVE-2025-3871MEDIUMBroken Access Control Leads to Limited Denial of Service in GoAnywhere MFT 7.8.0 and earlierEPSS 0.4%