# GoAnywhere MFT中的认证绕过漏洞
## 概述
Fortra的GoAnywhere MFT在7.4.1之前的版本中存在认证绕过漏洞，允许未经授权的用户通过管理门户创建管理员用户。
## 影响版本
- 版本 < 7.4.1
## 细节
未经授权的用户可以通过管理门户创建一个管理员账户，从而绕过认证机制。
## 影响
此漏洞可能导致未经授权的用户获得系统管理员权限，从而控制整个系统。
是否为 Web 类漏洞： 是
判断理由：
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | Authentication Bypass in GoAnywhere MFT | https://github.com/horizon3ai/CVE-2024-0204 | POC详情 |
| 2 | Scanning for vulnerable GoAnywhere MFT CVE-2024-0204 | https://github.com/cbeek-r7/CVE-2024-0204 | POC详情 |
| 3 | This script exploits the CVE-2024-0204 vulnerability in Fortra GoAnywhere MFT, allowing the creation of unauthorized administrative users, for educational and authorized testing purposes. | https://github.com/m-cetin/CVE-2024-0204 | POC详情 |
| 4 | GoAnywhere MFT | https://github.com/adminlove520/CVE-2024-0204 | POC详情 |
| 5 | Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-0204.yaml | POC详情 |
| 6 | Fortra GoAnywhere MFT 7.4.1 - Authentication Bypass | https://github.com/ibrahmsql/CVE-2024-0204 | POC详情 |
| 7 | GoAnywhere MFT | https://github.com/anonymous-echo/CVE-2024-0204 | POC详情 |
暂无评论