CVE-2025-3871: Broken Access Control Leads to Limited Denial of Service in GoAnywhere MFT 7.8.0 and earlier
Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere One-Time Password (GOTP) email two-factor authentication (2FA) and the user has not set an email address. In this scenario, the attacker may enter the email address of a known user when prompted and the user will be disabled if that user has configured GOTP.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3871?
The severity of CVE-2025-3871 is considered high due to its potential to cause denial of service.
How do I fix CVE-2025-3871?
To fix CVE-2025-3871, upgrade Fortra's GoAnywhere MFT to version 7.8.1 or later.
Who is affected by CVE-2025-3871?
Users of Fortra's GoAnywhere MFT prior to version 7.8.1 who utilize the One-Time Password email two-factor authentication are affected.
What causes the vulnerability in CVE-2025-3871?
The vulnerability in CVE-2025-3871 is caused by broken access control related to email configuration for two-factor authentication.
Can CVE-2025-3871 lead to data exposure?
While CVE-2025-3871 primarily causes denial of service, it may indirectly lead to difficulties in accessing important data during an attack.