7.2
CVSSv3

CVE-2023-0669

Published: 06/02/2023 Updated: 10/04/2023
CVSS v3 Base Score: 7.2 | Impact Score: 5.9 | Exploitability Score: 1.2
VMScore: 0

Vulnerability Summary

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

fortra goanywhere managed file transfer

Exploits

Goanywhere Encryption Helper version 711 suffers from a remote code execution vulnerability ...
This Metasploit module exploits an object deserialization vulnerability in Fortra GoAnywhere MFT ...
This module exploits CVE-2023-0669, which is an object deserialization vulnerability in Fortra GoAnywhere MFT ...

Metasploit Modules

Fortra GoAnywhere MFT Unsafe Deserialization RCE

This module exploits CVE-2023-0669, which is an object deserialization vulnerability in Fortra GoAnywhere MFT.

msf > use exploit/multi/http/fortra_goanywhere_rce_cve_2023_0669
msf exploit(fortra_goanywhere_rce_cve_2023_0669) > show targets
    ...targets...
msf exploit(fortra_goanywhere_rce_cve_2023_0669) > set TARGET < target-id >
msf exploit(fortra_goanywhere_rce_cve_2023_0669) > show options
    ...show and set options...
msf exploit(fortra_goanywhere_rce_cve_2023_0669) > exploit

Github Repositories

CVE-2023-0669 GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object.

CVE-2023-0669 GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object Dork shodan title:"GoAnywhere" FOFA title="GoAnywhere" Use Java Version java -version ope

GoAnywhere MFT CVE-2023-0669 LicenseResponseServlet Deserialization Vulnerabilities Python RCE PoC(Proof of Concept)

CVE-2023-0669 GoAnywhere MFT 反序列化 - Je Yiuwai's Blog CVE-2023-0669 CVE-2023-0669是一个GoAnywhere MFT反序列化漏洞,由于反序列化一个任意攻击者控制的对象,在License Response Servlet中存在一个预先认证的命令注入漏洞。攻击者可以利用该漏洞在受影响的系统上执行任意代码,从而导致系统被完全控制

CVE-2023-0669 GoAnywhere MFT command injection vulnerability

CVE-2023-0669 CVE-2023-0669 GoAnywhere MFT command injection vulnerability

CVE analysis for CVE-2023-0669

CVE-2023-0669 This Repo contain the pcakages and scripts used in this Analysis wwwvicariusio/vsociety/blog/unauthenticated-rce-in-goanywhere The vulnerable version of GoAnywhere for Linux wwwdropboxcom/s/j31l8lgvapbopy3/ga7_0_3_linux_x64sh?dl=0

CVE analysis for CVE-2023-0669

CVE-2023-0669 This Repo contain the pcakages and scripts used in this Analysis wwwvicariusio/vsociety/blog/unauthenticated-rce-in-goanywhere The vulnerable version of GoAnywhere for Linux wwwdropboxcom/s/j31l8lgvapbopy3/ga7_0_3_linux_x64sh?dl=0

EPSS(Exploit Prediction Scoring System) API client

EPSS API Client EPSS(Exploit Prediction Scoring System) API client EPSS is the one of famous vulnerability score developed by FIRST (the Forum of Incident Response and Security Teams) EPSS's definition: The Exploit Prediction Scoring System (EPSS) is an open, data-driven effort for estimating the likelihood (probability) that a software vulnerability will be exp

Recent Articles

MOVEit Vulnerabilities: What You Need to Know
Symantec Threat Intelligence Blog • Threat Hunter Team • 12 Jun 2024

Symantec products guard against exploitation of vulnerabilities that are being actively exploited by cyber-crime actors.

Posted: 12 Jun, 20233 Min ReadThreat Intelligence SubscribeFollowtwitterlinkedinMOVEit Vulnerabilities: What You Need to KnowSymantec products guard against exploitation of vulnerabilities that are being actively exploited by cyber-crime actors.Extortion actors have been actively exploiting a recently patched vulnerability in MOVEit Transfer, a file-transfer application that is widely used to transmit information between organizations. The nature of the ...

LockBit victims in the US alone paid over $90m in ransoms since 2020
The Register

Topics Security Off-Prem On-Prem Software Offbeat Special Features Vendor Voice Vendor Voice Resources As America, UK, Canada, Australia and friends share essential bible to detect and thwart infections

Seven nations today issued an alert, plus protection tips, about LockBit, the prolific ransomware-as-a-service gang. The group's affiliates remains a global scourge, costing US victims alone more than $90 million from roughly 1,700 attacks since 2020, we're told. The joint security advisory — issued by the US Cybersecurity and Infrastructure Security Agency (CISA), FBI, Multi-State Information Sharing and Analysis Center (MS-ISAC), and cybersecurity authorities in Australia, Canada, the UK, Ge...