CVEvulnerability

CVE-2025-8148

4.2 MEDIUM Published 2025-12-05 Modified 2026-09-25 Official page ↗
Status
Analyzed
Published
2025-12-05
Last modified
2026-09-25
Assigner
df4dee71-de3a-4139-9588-11b62fe6c0ff
CVSS 3.1 (df4dee71-de3a-4139-9588-11b62fe6c0ff)
4.2 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-732, CWE-863

Description

An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.

Affected configurations

• fortra goanywhere managed file transfer (< 7.9.0)

Related

Weakness · CWE (2)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness
  • CWE-863 Incorrect Authorization weakness

References