« Volver al listado

CVE-2025-3871

Estado: AplazadaMedia (5.3)—

Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere One-Time Password (GOTP) email two-factor authentication (2FA) and the user has not set an email address. In this scenario, the attacker may enter the email address of a known user when prompted and the user will be disabled if that user has configured GOTP.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Fortra — Goanywhere MFTAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-3871",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-3871",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-18T14:52:21.643028Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff",
      "affectedData": [
        {
          "vendor": "Fortra",
          "product": "GoAnywhere MFT",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "7.8.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-16T14:15:24.900",
  "references": [
    {
      "url": "https://www.fortra.com/security/advisories/product-security/FI-2025-009",
      "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "df4dee71-de3a-4139-9588-11b62fe6c0ff",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere One-Time Password (GOTP) email two-factor authentication (2FA) and the user has not set an email address. In this scenario, the attacker may enter the email address of a known user when prompted and the user will be disabled if that user has configured GOTP."
    },
    {
      "lang": "es",
      "value": "Un control de acceso deficiente en GoAnywhere MFT de Fortra anterior a la versión 7.8.1 permite a un atacante crear una situación de denegación de servicio cuando se configura para usar la autenticación de dos factores (2FA) de correo electrónico de GoAnywhere One-Time Password (GOTP) y el usuario no ha configurado una dirección de correo electrónico. En este caso, el atacante puede introducir la dirección de correo electrónico de un usuario conocido cuando se le solicite, y este quedará inhabilitado si ha configurado GOTP."
    }
  ],
  "lastModified": "2026-06-17T09:20:50.277",
  "sourceIdentifier": "df4dee71-de3a-4139-9588-11b62fe6c0ff"
}