Fortra GoAnywhere MFT SFTP Brute Force Vulnerability

A vulnerability exists in Fortra's GoAnywhere MFT SFTP service in versions prior to 7.10.0. The issue arises because the login limit is not enforced for Web Users configured to authenticate using SSH keys. This lack of restriction allows for brute force attacks to guess the SSH keys.

Impact

Exploitation of this vulnerability could lead to successful brute force attacks on SSH key authentication, potentially allowing unauthorized access.

Remediation

Users are advised to upgrade to GoAnywhere MFT version 7.10.0 or later, where this vulnerability has been addressed.