CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2024-11922: Input Validation vulnerability in Web Client emails that do not go through Secure Mail
6.3
CVSS
Description
Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emails to insert arbitrary HTML or JavaScript into an email.
Classification
CVE ID: CVE-2024-11922
CVSS Base Severity: MEDIUM
CVSS Base Score: 6.3
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Problem Types
CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')Affected Products
Vendor: Fortra
Product: GoAnywhere MFT
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.03% (probability of being exploited)
EPSS Percentile: 7.04% (scored less or equal to compared to others)
EPSS Date: 2025-05-27 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2024-11922https://www.fortra.com/security/advisories/product-security/fi-2025-005