CVE-2023-0669
KEV RANSOMWAREHIGH 7.2EPSS 100.0%
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
- CVSS v3.1
- 7.2 HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1
- 7.2 HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - EPSS
- 100.00% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2023-02-10, used in ransomware campaigns
- Nuclei
- high · CWE-502
- Published
- 2023-02-06
- Updated
- 2026-08-06
Proof-of-concept exploits (9)
- http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Cod…
- https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis
- https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html
- https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulne…
- 0xf4n9x/CVE-2023-0669102★ · 2024-04-16
- Avento/CVE-2023-06698★ · 2023-07-07
- cataiovita/CVE-2023-06690★ · 2023-02-15
- cataliniovita/CVE-2023-06690★ · 2023-02-15
- zakaria-laouani/cve-2023-0669-simulation