GHSA-mjq8-gg9x-87gr

FitNesse Cross-site Scripting vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-28128

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.fitnesse:fitnesse	< 20220319	20220319

Details

As written in the advisory (Markdown source, shown as plain text).

Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product and accessing a link with a specially crafted certain parameter.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-28128 advisory
https://github.com/unclebob/fitnesse package
https://github.com/unclebob/fitnesse/blob/master/SECURITY.md web
https://jvn.jp/en/jp/JVN94521208 web
http://fitnesse.org/FitNesseDownload web