CVE-2024-28125 Security Details

CVE ID

CVE-2024-28125

CWE

CWE-77

CWE-78

CVE Description

FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands. Note: A contributor of FitNesse has claimed that this is not a vulnerability but a product specification and this is currently under further investigation.

Published

Mar 18, 2024

CVSS Score & Severity

8.8High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

0.510%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

fitnesseMain/FitNesseMain.executeSingleCommand(Lfitnesse/FitNesse;Ljava/lang/String;Ljava/lang/String;)V

JVMVulnerable params: 1

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · Advisory · GHSA-x9r9-48rm-4xm6THIRD_PARTY