Fortra · GoAnywhere MFT
CVE-2023-0669
Fortra GoAnywhere MFT License Response Servlet Command Injection
What it is
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
CISA: Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: March 3, 2023
- Added to the CISA list
- February 10, 2023
- Published
- February 6, 2023
- Severity
- High 7.2 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- >99.9% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-502
- More details
- NVD · CVE.org · CISA
All references (8)
- https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1
- https://infosec.exchange/@briankrebs/109795710941843934
- https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/
- https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis
- https://github.com/rapid7/metasploit-framework/pull/17607
- https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft
- https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html
- http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html
More exploited flaws from Fortra
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 29, 2025 | Deserialization of Untrusted Data | GoAnywhere MFT | Critical 10.0 | 99.8% |
| Mar 30, 2023 | Teamserver Cross-Site Scripting (XSS) | Cobalt Strike | Medium 6.1 | 47% |
| Mar 30, 2023 | User Interface Remote Code Execution | Cobalt Strike | Critical 9.8 | 2.7% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.