CVE-2024-0204Authentication Bypass in GoAnywhere MFT
- 9.8CriticalCVSS base score
- 95.1%Exploitation in 30 daysEPSS · top 0.1% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- 3Public exploitsMetasploit, Nuclei and Exploit-DB
Description
Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. The public collections list a Metasploit module, a Nuclei template and an Exploit-DB entry for it.
Show the exploits3
Metasploit modules1 module
- Fortra GoAnywhere MFT Unauthenticated Remote Code Execution (Metasploit module) (opens in a new tab)
exploit/multi/http/fortra_goanywhere_mft_rce_cve_2024_0204Rank excellentdisclosed 22 Jan 2024
Nuclei templates1 template
- Fortra GoAnywhere MFT - Authentication Bypass (Nuclei template) (opens in a new tab)
http/cves/2024/CVE-2024-0204.yamlSeverity critical
Exploit-DB1 entry
- Fortra GoAnywhere MFT 7.4.1 - Authentication Bypass (Exploit-DB entry) (opens in a new tab)
EDB-ID 52308remote, multiplepublished 29 May 2025Not verified
Modules, templates and exploits as listed by the Metasploit Framework (BSD-3-Clause), ProjectDiscovery's Nuclei templates (MIT) and the Exploit Database (GPLv2), read once a day. Where the data comes from
Timeline
ID reserved
By Fortra
- 19 days later
· 19 days later
Published
- 16 months later
· 16 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| FortraCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 95.1% · top 0.1% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Affected products
- affected 6.0.1 – < 7.4.1
What to do
Solution: Upgrade to version 7.4.1 or higher. The vulnerability may also be eliminated in non-container deployments by deleting the InitialAccountSetup.xhtml file in the install directory and restarting the services. For container-deployed instances, replace the file with an empty file and restart. For additional information, see https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml (registration required). https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml
Workaround: Users are encouraged to apply defense-in-depth tactics to limit access to the administrative console. Do not expose the console to the internet and apply web application controls such as a WAF, monitoring, and access controls.
References
References4
- https://www.fortra.com/security/advisory/fi-2024-001 (opens in a new tab)vendor-advisoryx_transferred
- https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml (opens in a new tab)permissions-requiredx_transferred
- http://packetstormsecurity.com/files/176683/GoAnywhere-MFT-Authentication-Bypass.html (opens in a new tab)x_transferred
- http://packetstormsecurity.com/files/176974/Fortra-GoAnywhere-MFT-Unauthenticated-Remote-Code-Execution.html (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-16003 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-0204)Record last updated .