CVE-2023-0669

Fortra Goanywhere MFT

Published 6 Feb 2023 · updated 6 Aug 2026 · Analyzed

7.2 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 10 Feb 2023, with a remediation deadline of 3 Mar 2023 for US federal agencies. It has been used in ransomware campaigns.

Required action: Apply updates per vendor instructions.

Description

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

References

packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html · Exploit, Third Party Advisory, VDB Entry
attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis · Exploit, Third Party Advisory
duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft · Broken Link, Third Party Advisory
frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html · Exploit, Third Party Advisory
github.com/rapid7/metasploit-framework/pull/17607 · Patch
infosec.exchange/@briankrebs/109795710941843934 · Mitigation, Third Party Advisory
my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1 · Product
www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/ · Mitigation, Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-0669 · US Government Resource