Fortra® Security & Trust Center

Security Advisory

Limited Information Disclosure in GoAnywhere MFT Prior to 7.7.0

Fri, 12/13/2024
An information-disclosure vulnerability exists in Fortra's GoAnywhere MFT application prior to version 7.7.0 that allows external access to the resources in certain admin root folders. NOTE: By default, these folders don't typically contain any sensitive data.
FI-2024-014
Medium
CVE-2024-9945
Patch Tuesday
Blog

Patch Tuesday Update December 2024

By Tyler Reguly on Thu, 12/12/2024
While not the smallest December Patch Tuesday we’ve ever had, there are only 72 CVEs this month, with only one that has been publicly disclosed and exploited and one that scores above a CVSS 9.0. 
Emerging Threats

Cleo Unrestricted File Upload & Download Vulnerability

Wed, 12/11/2024
Fortra is actively researching a new vulnerability in three products from Cleo – Cleo Harmony, Cleo VLTrader, and Cleo LexiCom. This vulnerability, CVE-2024-50623, can allow unrestricted file upload and download, which can lead to remote code execution. Active exploitation of the vulnerability has been reported. Cleo has released patches to address this vulnerability, and affected customers are strongly advised to to update their instances as soon as possible.
Emerging Threats

IdentityIQ Improper Access Control Vulnerability

Thu, 12/05/2024
Fortra is actively researching an improper access control vulnerability in SailPoint’s IdentityIQ– CVE-2024-10905. This vulnerability could allow unauthorized HTTP access to static content in the IdentityIQ application directory. SailPoint has released fixes for this vulnerability, which customers should apply as soon as possible.
Blog

Cloudflare’s pages.dev and workers.dev Domains Increasingly Abused for Phishing

By Cybersecurity Experts at Fortra on Mon, 12/02/2024
Fortra has observed a rising trend in legitimate service abuse, with a significant volume of attacks targeting Cloudflare Pages. Workers.dev is a domain used by Cloudflare Workers’ deployment services, while Pages.dev is used by Cloudflare’s Pages platform that facilitates the development of web pages and sites. Fortra’s Suspicious Email Analysis (SEA) team has identified different threats being...
Threat Research & Intelligence
Emerging Threats

Palo Alto Exploit Chain to Remote Code Execution

Wed, 11/20/2024
Fortra is actively researching new vulnerabilities in Palo Alto PAN-OS – CVE-2024-0012 and CVE-2024-9474. When combined, these two vulnerabilities allow for an exploit chain to achieve remote code execution. The first CVE allows an unauthenticated attacker with access to the web management interface to gain administrator privileges on the PAN-OS device, while the second CVE allows administrators to perform actions on the firewall with root privileges. Palo Alto has released fixed versions of PAN-OS to address these vulnerabilities, and customers are recommended to upgrade as soon as possible.
Security Advisory

USB Security Feature Bypass in Digital Guardian Windows Agent Prior to version 8.2.0

Fri, 11/15/2024
A security bypass vulnerability exists in the Removable Media Encryption (RME) component of Digital Guardian Windows Agents prior to version 8.2.0. This allows a user to circumvent encryption controls by modifying metadata on the USB device thereby compromising the confidentiality of the stored data.NOTE: Data already encrypted on the device is unaffected by this change
FI-2024-013
Medium
CVE-2024-3334
Emerging Threats

Missing Authentication Vulnerability in Palo Alto Expedition

Fri, 11/08/2024
Fortra is actively researching a vulnerability in Palo Alto Networks Expedition – CVE-2024-5910. Palo Alto Networks Expedition is a tool designed to assist with migrating other vendor configurations to Palo Alto devices. CVE-2024-5910 allows attackers to remotely reset administrator credentials, gaining complete access to Expedition and all of the data stored within. Customers are recommended to upgrade to a fixed version of Expedition.
Emerging Threats

Missing Authentication Vulnerability in FortiManager

Thu, 10/24/2024
Fortra is actively researching a new vulnerability in FortiManager – CVE-2024-47575. A critical function in FortiManager fgfmd daemon may allow a remote unauthenticated attacker to execute code or commands via specially crafted requests. FortiGuard has released updates for FortiManager to address this vulnerability, which should be implemented in customer systems as soon as possible.