Weakness
Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize a static IV which allows admin users to brute-force decryption of data.
Affected products
- fortra goanywhere_agents
- fortra goanywhere_managed_file_transfer
- apple macos
- linux linux_kernel
- microsoft windows
References
Find the bug before an attacker does.
Sign in with GitHub and run your first audit in under a minute. The free plan needs no credit card.