GitHub Advisoryadvisory · Maven

GHSA-x9r9-48rm-4xm6 FitNesse allows execution of arbitrary OS commands

CRITICAL Published 2024-03-18 Modified 2025-09-19 Official page ↗

Aliases: CVE-2024-28125
Ecosystem: Maven
Packages: org.fitnesse:fitnesse
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-77, CWE-78
Reviewed: 2024-08-29

Affected packages

• Maven org.fitnesse:fitnesse: <= 20240707 (no fix yet)

Description

FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands.

Related

Alias · CVE (1)

CVE-2024-28125 FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands. vulnerability

Weakness · CWE (2)

CWE-77 Improper Neutralization of Special Elements used in a Command weakness
CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References