GitHub Advisoryadvisory · Maven

GHSA-mjq8-gg9x-87gr FitNesse Cross-site Scripting vulnerability

MEDIUM Published 2024-03-18 Modified 2025-03-21 Official page ↗
Aliases
CVE-2024-28128
Ecosystem
Maven
Packages
org.fitnesse:fitnesse
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-03-21

Affected packages

• Maven org.fitnesse:fitnesse: < 20220319 → fixed in 20220319

Description

Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product and accessing a link with a specially crafted certain parameter.

Related

Alias · CVE (1)

  • CVE-2024-28128 Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References