GHSA-mpx3-mx2p-9gv3

Improper Neutralization of Special Elements used in a Command in FitNesse Wiki

Source: GitHub Advisory Database (reviewed) High CVE-2014-1216

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.fitnesse:fitnesse	>= 20131110, < 20140418	20140418

Details

As written in the advisory (Markdown source, shown as plain text).

FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RUNNER in the pageContent parameter when editing a page.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2014-1216 advisory
http://www.exploit-db.com/exploits/32568 web