Fortra® Security & Trust Center

Security Advisory

Improper Authentication in Tripwire Enterprise 9.1 APIs

Mon, 06/03/2024
An authentication bypass vulnerability has been identified in the REST and SOAP API components of Tripwire Enterprise (TE) 9.1.0 when TE is configured to use LDAP/Active Directory SAML authentication and its optional "Auto-synchronize LDAP Users, Roles, and Groups" feature is enabled. This vulnerability allows unauthenticated attackers to bypass authentication if a valid username is known....
FI-2024-006
Critical
CVE-2024-4332
Blog

Patch Tuesday Update May 2024

By Tyler Reguly on Wed, 05/15/2024
This month everyone is going to be talking about CVE-2024-30051 since it is known that it is being used in QakBot and other malware. This is an update that should be applied as soon as possible given the nature of the vulnerability and the fact that real world exploitation has been confirmed.
Emerging Threats

ArcaneDoor - Cisco Vulnerabilities

Fri, 04/26/2024
Fortra is actively investigating an attack campaign dubbed “ArcaneDoor” against Cisco Adaptive Security Appliances (ASA) and Cisco Firepower Threat Defense (FTD) software. The campaign has been used to implant malware, execute commands, and potentially exfiltrate data. While the initial attack vector has not yet been identified, Cisco has identified three vulnerabilities impacting these devices, two of which have been used within the attack. CVE-2024-20353 CVE-2024-20358 CVE-2024-20359 All three vulnerabilities have been patched as part of the Cisco Threat Response.
Emerging Threats

OS Command Injection Vulnerability in GlobalProtect Gateway

Fri, 04/12/2024
Fortra is investigating a command injection vulnerability in the GlobalProtect Gateway in Palo Alto PAN-OS – CVE-2024-3400. The command injection allows an unauthenticated attacker to execute code on the device with root privileges. The vendor has announced mitigations for this vulnerability and is actively working on patches that are scheduled to be released on 04/14/2024.
Security Advisory

Privilege Escalation in Robot Schedule Enterprise Agent for Windows prior to version 3.04

Thu, 03/28/2024
Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation. A low-privileged user can overwrite the service executable. When the service is restarted, the replaced binary runs with local system privileges, allowing a low-privileged user to gain elevated privileges.
FI-2024-005
Critical
CVE-2024-0259
Security Advisory

Path Traversal in GoAnywhere MFT 7.4.1 and Earlier

Thu, 03/14/2024
A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywhere Admin and Web Clients. Using a crafted URL, an unauthorized user may access pages within GoAnywhere. This may lead to information disclosure. In non-default configurations it may also allow web user self-registration in some...
FI-2024-004
Medium
CVE-2024-25156
Patch Tuesday
Blog

Patch Tuesday Update March 2024

By Tyler Reguly on Thu, 03/14/2024
This month’s Patch Tuesday drop includes a total of 65 CVEs – 61 issues by Microsoft, 3 issued by Chrome, and 1 issued by Intel. For those worried about the Intel update, which requires you apply both an Intel microcode update and a Microsoft update, it only applies to Atom processors.
Security Advisory

Multiple Vulnerabilities in FileCatalyst Direct

Wed, 03/13/2024
A pair of vulnerabilities exist within FileCatalyst Direct 3.8.8 and earlier. See the vulnerability descriptions below for additional details.
FI-2024-003
Medium
CVE-2024-25154