Threat database

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

Improper Access Control issue in the Workflow component of Fortra's FileCatalyst allows unauthenticated users to upload arbitrary files via the order forms page.

EPSS 0.3%VulnerabilityFortra#cwe-434#cwe-306Germany+9

Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere One-Time Password (GOTP) email two-factor authentication (2FA) and the user has not set an email address. In this scenario, the attacker may enter the email address of a known user when prompted and the user will be disabled if that user has configured GOTP.

EPSS 0.4%VulnerabilityFortra#cwe-862Germany+6

A binary in the BoKS Server Agent component of Fortra's Core Privileged Access Manager (BoKS) on versions 7.2.0 (up to 7.2.0.17), 8.1.0 (up to 8.1.0.22), 8.1.1 (up to 8.1.1.7), 9.0.0 (up to 9.0.0.1) and also legacy tar installs of BoKS 7.2 without hotfix #0474 on Linux, AIX, and Solaris allows low privilege local users to dump data from the cache.

EPSS 0.1%VulnerabilityFortra#cwe-524Germany+7

Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.

EPSS 95%VulnerabilityFortra#cwe-425Germany+9

CVE-2022-42948 is a high-severity remote code execution vulnerability in the Fortra Cobalt Strike User Interface. The flaw is rooted in Java Swing components and allows remote attackers to execute arbitrary code. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

CVE-2022-39197 is a high-severity cross-site scripting (XSS) vulnerability in Fortra Cobalt Strike's Teamserver component. It allows an attacker to set a malformed username in the Beacon configuration, enabling remote code execution. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

KEVEPSS 99%VulnerabilityFortra#cwe-502Germany+6