Fortra GoAnywhere Web Client Input Validation Vulnerability Allowing Cross-Site Scripting in Emails

A cross-site scripting vulnerability has been identified in Fortra's GoAnywhere Web Client, in versions prior to 7.8.0. This issue arises from missing input validation in certain features, allowing an attacker with permission to send emails to inject arbitrary HTML or JavaScript into the message. The vulnerability is particularly concerning for emails that do not use Secure Mail.

Impact

Exploitation of this vulnerability could lead to cross-site scripting attacks, where injected scripts are executed in the context of the user's browser.

Remediation

Users can upgrade to GoAnywhere MFT version 7.8.0 or later to address this vulnerability. It is also recommended to limit access to only trustworthy Web Users.