Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2024-28125: FitNesse allows attackers to run commands on your computer
CVE-2024-28125 · published 2 years ago
Summary
An attacker who has a FitNesse account can run any computer command, potentially causing harm. This means you should be cautious when allowing users to have accounts on your FitNesse system. Consider revoking access or updating to a fixed version when available.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | fitnesse | org.fitnesse:fitnesse | <= 20240707 |
Original advisory text
FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands. Note: A contributor of FitNesse has claimed that this is not a vulnerability but a product specificati...
FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands. Note: A contributor of FitNesse has claimed that this is not a vulnerability but a product specification and this is currently under further investigation.
References
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-77Command Injection
CWE-78OS Command Injection
Timeline
Published18 Mar 2024
Updated3 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta