CVE-2024-0204: Critical Fixes in kiosk mode on ChromeOS
Published Jan 22, 2024
·Updated
Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.
Affected Software
3 affected components
Fortra GoAnywhere MFT=7.4.1
Fortra Goanywhere Managed File Transfer>=7.0.0<7.4.1
Fortra Goanywhere Managed File Transfer=6.0.0
Remediation
Information
Upgrade to version 7.4.1 or higher. The vulnerability may also be eliminated in non-container deployments by deleting the InitialAccountSetup.xhtml file in the install directory and restarting the services. For container-deployed instances, replace the file with an empty file and restart. For additional information, see https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml (registration required). https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml
Event History
Jan 22, 2024
CVE Published
via MITRE·06:05 PM
Data Sourced
via MITRE·06:05 PM
RemedyDescriptionSeverityWeakness
Jan 23, 2024
News Published
via BleepingComputer·03:41 PM
News Published
via BleepingComputer·03:42 PM
News Published
via BleepingComputer·11:16 PM
Jan 24, 2024
News Published
via The Register·03:04 PM
News Published
via The Register·03:09 PM
Mar 11, 2024
Data Sourced
12:00 AM
SeverityWeakness
May 29, 2025
Exploit Published
12:00 AM
Known Exploited
10:17 AM
Sep 19, 2025
News Published
via The Register·02:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-0204?
CVE-2024-0204 is considered a critical severity vulnerability due to its potential for authentication bypass.
2
How do I fix CVE-2024-0204?
To fix CVE-2024-0204, upgrade Fortra GoAnywhere MFT to version 7.4.1 or later.
3
What does CVE-2024-0204 allow an attacker to do?
CVE-2024-0204 allows an unauthorized user to create an admin user via the administration portal.
4
Which versions of Fortra's GoAnywhere MFT are affected by CVE-2024-0204?
CVE-2024-0204 affects Fortra GoAnywhere MFT versions from 6.0.0 to 7.4.0.
5
Is there an exploit available for CVE-2024-0204?
Yes, an exploit for CVE-2024-0204 has been published, enabling attackers to leverage the authentication bypass.