CVE-2024-9945

Limited Information Disclosure in GoAnywhere MFT Prior to 7.7.0

State: Published
Severity: 5.3 Medium
Published: Dec 13, 2024
Updated: Aug 29, 2025
Reserved: Oct 14, 2024

Description

An information-disclosure vulnerability exists in Fortra's GoAnywhere MFT application prior to version 7.7.0 that allows external access to the resources in certain admin root folders.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	Fortra

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-425 Direct Request ('Forced Browsing')
CWE-552 Files or Directories Accessible to External Parties

Affected Products

Product	Versions
GoAnywhere MFTFortra	before 7.7.0Affected

References

https://www.fortra.com/security/advisories/product-security/fi-2024-014vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.