{"id":"CVE-2024-0204","published":"2024-01-22T18:05:13Z","modified":"2025-05-30T14:22:31Z","title":"Authentication Bypass in GoAnywhere MFT","vendor":"Fortra","product":"GoAnywhere MFT","tier":"core","eol":null,"affectedVersions":[{"vendor":"Fortra","product":"GoAnywhere MFT","versions":[">= 6.0.1, < 7.4.1"]}],"description":{"text":"Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.","provenance":"source","from":"CVE.org"},"summary":{"text":"Fortra's GoAnywhere MFT, in versions prior to 7.4.1, contains an authentication bypass flaw in its administration portal. An unauthenticated attacker with network access to the administration portal can exploit it without credentials or user interaction to create a new administrative user.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:36:27Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.95086,"percentile":0.99862,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-01-25","exploitedFirstSeen":"2024-01-25","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-25&host_type=src&vulnerability=cve-2024-0204","date":"2024-01-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-26&host_type=src&vulnerability=cve-2024-0204","date":"2024-01-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-27&host_type=src&vulnerability=cve-2024-0204","date":"2024-01-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-28&host_type=src&vulnerability=cve-2024-0204","date":"2024-01-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-29&host_type=src&vulnerability=cve-2024-0204","date":"2024-01-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-30&host_type=src&vulnerability=cve-2024-0204","date":"2024-01-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-31&host_type=src&vulnerability=cve-2024-0204","date":"2024-01-31"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-01&host_type=src&vulnerability=cve-2024-0204","date":"2024-02-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-02&host_type=src&vulnerability=cve-2024-0204","date":"2024-02-02"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-03&host_type=src&vulnerability=cve-2024-0204","date":"2024-02-03"}],"evidenceTotal":777,"provenance":"source"},"exploited":true,"otx":{"pulseCount":12,"pulses":[{"name":"New Chaos RAT Variants Threaten Windows and Linux Systems with Stealthy Data Theft","url":"https://otx.alienvault.com/pulse/6843300336b121603e3cffad","created":"2025-06-06"},{"name":"APT29 Exploits Rogue RDP in October 2024 Hacking Campaign","url":"https://otx.alienvault.com/pulse/676652f7b1080740c101e9e9","created":"2024-12-21"},{"name":"APT29 Exploits Rogue RDP in October 2024 Hacking Campaign","url":"https://otx.alienvault.com/pulse/676652f7393d00df56cffdc0","created":"2024-12-21"},{"name":"APT29 Exploits Rogue RDP in October 2024 Hacking Campaign","url":"https://otx.alienvault.com/pulse/676652f7a55e1301c9233e6c","created":"2024-12-21"},{"name":"APT29 Exploits Rogue RDP in October 2024 Hacking Campaign","url":"https://otx.alienvault.com/pulse/676652f78bbff8f3a7dcb4c3","created":"2024-12-21"},{"name":"APT29 Exploits Rogue RDP in October 2024 Hacking Campaign","url":"https://otx.alienvault.com/pulse/676652f6a7ad2f6c63bac5d6","created":"2024-12-21"},{"name":"BlueNoroff used macOS malware with novel persistence","url":"https://otx.alienvault.com/pulse/672d552ee02b6697ba5e6474","created":"2024-11-08"},{"name":"CISA adds Ivanti Virtual Traffic Manager flaw to its Exploited Vulnerabilities List","url":"https://otx.alienvault.com/pulse/66f3d4dff860d18695313fd6","created":"2024-09-25"},{"name":"Chalubo malware destroy 600,000 SOHO routers in 72 hours","url":"https://otx.alienvault.com/pulse/665a1fc3ee450e5f92ad6322","created":"2024-05-31"},{"name":"ACTUALIZACION | Long Term Support Channel Update for ChromeOS","url":"https://otx.alienvault.com/pulse/65ef3d025e2449674e623ae7","created":"2024-03-11"}],"provenance":"machine"},"cwes":[{"id":"CWE-425","name":"Direct Request"}],"references":[{"url":"https://www.fortra.com/security/advisory/fi-2024-001","tags":["vendor-advisory"]},{"url":"https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml","tags":["permissions-required"]},{"url":"http://packetstormsecurity.com/files/176683/GoAnywhere-MFT-Authentication-Bypass.html","tags":[]},{"url":"http://packetstormsecurity.com/files/176974/Fortra-GoAnywhere-MFT-Unauthenticated-Remote-Code-Execution.html","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-16003","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-16003","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":52308,"url":"https://www.exploit-db.com/exploits/52308","title":"Fortra GoAnywhere MFT 7.4.1 - Authentication Bypass","type":"remote","platform":"multiple","date":"2025-05-29","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2025-05-29"},"pocGithub":{"count":3,"skipped":0,"earliest":"2024-01-23","earliestUrl":"https://github.com/horizon3ai/CVE-2024-0204","repos":[{"name":"horizon3ai/CVE-2024-0204","url":"https://github.com/horizon3ai/CVE-2024-0204","stars":65,"created":"2024-01-23"},{"name":"cbeek-r7/CVE-2024-0204","url":"https://github.com/cbeek-r7/CVE-2024-0204","stars":5,"created":"2024-01-23"},{"name":"m-cetin/CVE-2024-0204","url":"https://github.com/m-cetin/CVE-2024-0204","stars":2,"created":"2024-01-24"}]},"metasploit":[{"name":"Fortra GoAnywhere MFT Unauthenticated Remote Code Execution","module":"exploit/multi/http/fortra_goanywhere_mft_rce_cve_2024_0204","type":"exploit","disclosureDate":"2024-01-22","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/fortra_goanywhere_mft_rce_cve_2024_0204.rb"}],"nuclei":[{"id":"CVE-2024-0204","name":"Fortra GoAnywhere MFT - Authentication Bypass","severity":"critical","path":"http/cves/2024/CVE-2024-0204.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0204.yaml"}],"first":{"date":"2024-01-22","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/fortra_goanywhere_mft_rce_cve_2024_0204.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/176683/GoAnywhere-MFT-Authentication-Bypass.html","http://packetstormsecurity.com/files/176974/Fortra-GoAnywhere-MFT-Unauthenticated-Remote-Code-Execution.html"],"flow":[],"timeline":[{"date":"2024-01-22","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-0204","provenance":"source"},{"date":"2024-01-22","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2024-01-23, Exploit-DB 2025-05-29","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/fortra_goanywhere_mft_rce_cve_2024_0204.rb","provenance":"source"},{"date":"2024-01-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-25&host_type=src&vulnerability=cve-2024-0204","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":69.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1010 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9986"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 2 NVD exploit links; 3 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":2.53,"detail":"12 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}