Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2025-0049
PUBLISHED
More InfoOfficial Page
Assigner-Fortra
Assigner Org ID-df4dee71-de3a-4139-9588-11b62fe6c0ff
View Known Exploited Vulnerability (KEV) details
Published At-28 Apr, 2025 | 20:55
Updated At-28 Apr, 2025 | 22:28
Rejected At-
▼CVE Numbering Authority (CNA)
Disclosure of sensitive information in an error message in GoAnywhere prior to version 7.8.0

When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for application mapping. This issue affects GoAnywhere: before 7.8.0.

Affected Products
Vendor
Fortra LLCFortra
Product
GoAnywhere
Default Status
unaffected
Versions
Affected
  • From 0 before 7.8 (semver)
Problem Types
TypeCWE IDDescription
CWECWE-209CWE-209 Generation of Error Message Containing Sensitive Information
Metrics
VersionBase scoreBase severityVector
3.13.5LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-215CAPEC-215 Fuzzing for application mapping
Solutions

Upgrade to GoAnywhere 7.8.0 or later.

Configurations

Workarounds

This issue occurs when the Web User does not have Create permission on Subfolders. It is a bug that happens when a user tries to upload a file to a directory that doesn’t exist yet (If they have permissions to create sub directories, then the non-existent directory would be created automatically). Note: This workaround requires supplying an additional permission that the Web User does not have in vulnerable configurations.

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://www.fortra.com/security/advisories/product-security/fi-2025-004
vendor-advisory
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
Details not found