Fortra® Security & Trust Center

Security Advisory

Authentication bypass in GoAnywhere MFT prior to 7.6.0

Wed, 08/14/2024
An authentication bypass vulnerability in GoAnywhere MFT prior to 7.6.0 allows Admin Users with access to the Agent Console to circumvent some permission checks when attempting to visit other pages. This could lead to unauthorized information disclosure or modification.
FI-2024-009
Medium
CVE-2024-25157
Security Advisory

Denial of Service in CLFS.sys

Mon, 08/12/2024
A Denial of Service in CLFS.sys in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authenticated low-privilege user to cause a Blue Screen of Death via a forced call to the KeBugCheckEx function.
FR-2024-001
Medium
CVE-2024-6768
Emerging Threats

VMWare Active Directory Vulnerability

Tue, 07/30/2024
Fortra is actively researching an authentication bypass vulnerability in VMware – CVE-2024-37085. This vulnerability can allow an attacker to bypass Active Directory integration authentication and obtain administrative access to a host. Updates from VMware and additional mitigation steps are available.
Patch Tuesday
Blog

Patch Tuesday Update July 2024

By Tyler Reguly on Thu, 07/11/2024
The first thing that everyone’s going to talk about this month is SQL Server. More than a quarter of the CVEs assigned by Microsoft this month describe SQL Server vulnerabilities. Thankfully, none of them are critical based on their CVSS scores and they’re all listed as “Exploitation Less Likely.”
Emerging Threats

ServiceNow Remote Code Execution Vulnerability

Wed, 07/10/2024
Fortra is actively investigating a vulnerability in the ServiceNow Vancouver and Washington, D.C. Now Platform releases. This vulnerability, CVE-2024-4879, could enable an unauthenticated user to remotely execute code within the Now Platform. ServiceNow has released an update, patches, and hot fixes to address this vulnerability.
Emerging Threats

OpenSSH Vulnerability - "regreSSHion"

Tue, 07/02/2024
Fortra is actively researching a new vulnerability in OpenSSH dubbed “regreSSHion”. This remote code execution vulnerability – CVE-2024-6387 – could allow an unauthenticated remote attacker to execute arbitrary code as root. Fortra recommends updating sshd as soon as possible to mitigate this threat.
Emerging Threats

Check Point VPN Vulnerability

Wed, 06/26/2024
Fortra is investigating a vulnerability in the Check Point VPN – CVE-2024-24919. This information disclosure vulnerability could allow an attacker to access sensitive information on internet-exposed Check Point Security Gateways with IPsec VPN in the Remote Access VPN community and the Mobile Access software blade. Security updates are available to mitigate this vulnerability.
Emerging Threats

MOVEit Transfer Improper Authentication

Wed, 06/26/2024
Fortra is actively researching an improper authentication vulnerability in MOVEit Transfer – CVE-2024-5806. This vulnerability in the SFTP Module of Progress MOVEit Transfer can lead to authentication bypass. Customers can upgrade to a patched release to mitigate this vulnerability.
Security Advisory

SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier)

Tue, 06/25/2024
A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Likely impacts include creation of administrative users and deletion or modification of data in the application database. Data exfiltration via SQL injection is not possible using this vulnerability. Successful unauthenticated exploitation requires a Workflow system with anonymous access...
FI-2024-008
Critical
CVE-2024-5276
Security Advisory

Hard-coded password in FileCatalyst Direct 3.8.10 Build 138 TransferAgent (and earlier) and FileCatalyst Workflow 5.1.6 Build 130 (and earlier)

Tue, 06/18/2024
A hard-coded password in the FileCatalyst TransferAgent can be found which can be used to unlock the keystore from which contents may be read out, for example, the private key for certificates. Exploit of this vulnerability could lead to a machine-in-the-middle (MiTM) attack against users of the agent. This issue affects all versions of FileCatalyst Direct from 3.8.10 Build 138 and earlier and all...
FI-2024-007
High
CVE-2024-5275