Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

← Past incidents
ClosedPatched

Fortra GoAnywhere MFT zero-day: Cl0p claims 130 victims

Fortra GoAnywhere MFT

A pre-auth deserialization/command injection in the GoAnywhere MFT admin console's License Response Servlet was exploited as a zero-day. The Cl0p gang said it stole data from more than 130 organisations, a rehearsal for the later MOVEit campaign.

Why this severity: CVSS 7.2 (NVD), zero-day, actively exploited (CISA KEV), known ransomware use

Started
Feb 1, 2023
Closed
Feb 10, 2023
CVE
CVE-2023-0669

Follow this incident

Affected

  • Before 7.1.2 (NVD)

Fixed in

  • 7.1.2

Updates by day3

▸Feb 10, 2023

Link #

  1. CISA adds CVE-2023-0669 to KEV; Cl0p claims it breached over 130 organisations

    Source

▸Feb 7, 2023

Link #

  1. Emergency patch: GoAnywhere MFT 7.1.2

    Source

▸Feb 1, 2023

Link #

  1. Fortra privately warns customers of an actively exploited zero-day in the GoAnywhere admin console

    Source

Advisories3

News & write-ups2

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo