CVE-2025-3871 Information

Jul 17, 2025 cve

Description

Broken access control in Fortra’s GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere One-Time Password (GOTP) email two-factor authentication (2FA) and the user has not set an email address. In this scenario the attacker may enter the email address of a known user when prompted and the user will be disabled if that user has configured GOTP.

Reference

https://www.fortra.com/security/advisories/product-security/FI-2025-009

CNNVD-202507-2229 (Published: 2025-07-16)

Share on: