org.fitnesse:fitnesse (Maven) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Maven package org.fitnesse:fitnesse, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (5)

• CVE-2024-28125 — CVSS 9.8 (critical): FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands. Note: A contributor of FitNesse has claimed…
• CVE-2014-1216 — CVSS 7.5 (high): FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and…
• CVE-2024-28128 — CVSS 6.1 (medium): Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to…
• CVE-2024-39610 — CVSS 6.1 (medium): Cross-site scripting vulnerability exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an arbitrary script…
• CVE-2024-42499 — CVSS 5.3 (medium): Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in FitNesse releases prior to 20241026. If this…