CVE-2024-0204: Critical Fixes in kiosk mode on ChromeOS
Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortra GoAnywhere MFTto a version that resolves this vulnerability.Fixed in 7.4.1 - Compensating control
For container-deployed instances, replace the InitialAccountSetup.xhtml file with an empty file and restart. For non-container deployments, delete InitialAccountSetup.xhtml from the install directory and restart the services.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0204?
CVE-2024-0204 is considered a critical severity vulnerability due to its potential for authentication bypass.
How do I fix CVE-2024-0204?
To fix CVE-2024-0204, upgrade Fortra GoAnywhere MFT to version 7.4.1 or later.
What does CVE-2024-0204 allow an attacker to do?
CVE-2024-0204 allows an unauthorized user to create an admin user via the administration portal.
Which versions of Fortra's GoAnywhere MFT are affected by CVE-2024-0204?
CVE-2024-0204 affects Fortra GoAnywhere MFT versions from 6.0.0 to 7.4.0.
Is there an exploit available for CVE-2024-0204?
Yes, an exploit for CVE-2024-0204 has been published, enabling attackers to leverage the authentication bypass.