CVE-2023-0669
Fortra GoAnywhere MFT License Response Servlet Command Injection
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
- Record
CVE-2023-0669- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
CVE List
Fortra GoAnywhere MFT License Response Servlet Command Injection
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
- Record
CVE-2023-0669- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2023-0644
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
- Record
EUVD-2023-0644- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6pm2-j2v8-h3cj
Withdrawn: Fortra GoAnywhere MFT Deserialization of Untrusted Data vulnerability affects metasploit-framework
Withdrawn
This advisory has been withdrawn because it was incorrectly associated with the metasploit-framework package, which is not affected by this CVE, and the actual vulnerable component does not fit within our supported ecosystems. This link is maintained to preserve external references.
Original Description
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object.
- Record
GHSA-6pm2-j2v8-h3cj- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
CISA KEV No score
Fortra GoAnywhere MFT Remote Code Execution Vulnerability
Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.
- Record
CVE-2023-0669- Weakness
- CWE-502
- Updated
- 2026-11-02
OSVGHSA-6pm2-j2v8-h3cj
Withdrawn: Fortra GoAnywhere MFT Deserialization of Untrusted Data vulnerability affects metasploit-framework
Withdrawn
This advisory has been withdrawn because it was incorrectly associated with the metasploit-framework package, which is not affected by this CVE, and the actual vulnerable component does not fit within our supported ecosystems. This link is maintained to preserve external references.
Original Description
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object.
- Record
GHSA-6pm2-j2v8-h3cj- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Fortra GoAnywhere MFT Unsafe Deserialization RCE | 2023-02-01 |
| PoC in GitHub | 0xf4n9x/CVE-2023-0669 | 2023-02-10 |
| PoC in GitHub | cataliniovita/CVE-2023-0669 | 2023-02-15 |
| PoC in GitHub | yosef0x01/CVE-2023-0669-Analysis | 2023-02-26 |
| PoC in GitHub | Avento/CVE-2023-0669 | 2023-04-06 |
| Exploit-DB | Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE) | 2023-04-08 |
| PoC in GitHub | zakaria-laouani/cve-2023-0669-simulation | 2025-12-24 |
| Nuclei | Fortra GoAnywhere MFT - Remote Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| affected, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-0669 is a high vulnerability (CVSS 7.2) in Fortra Goanywhere Mft, published February 6, 2023. CISA lists it as known to be exploited, since February 10, 2023. EUVD reports exploitation since February 10, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. No source names a fixed version.
References
my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml
infosec.exchange/@briankrebs/109795710941843934
rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability
attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis
github.com/rapid7/metasploit-framework/pull/17607
duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft
Show 6 moreShow less
frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html
packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-0669
nvd.nist.gov/vuln/detail/CVE-2023-0669