Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.fitnesse:fitnesse

5 known vulnerabilities (1 critical, 3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 1 critical, 3 medium
Registry
Maven Central

Advisories 5

  • CVE-2024-39610Medium 6.1

    Cross-site scripting vulnerability exists in FitNesse releases prior to 20241026.

    Affected: fixed in 20241026.

  • CVE-2024-42499Medium 5.3

    Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in FitNesse releases prior to 20241026.

    Affected: fixed in 20241026.

  • CVE-2024-28128Medium 6.1

    Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to…

    Affected: fixed in 20220319.

  • CVE-2024-28125Critical 9.8

    FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands.

    Affected: through 20240707.

  • FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and…

    Affected: from 20131110, fixed in 20140418.