GHSA-pg82-9w35-3w3r

FitNesse Cross-site scripting

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-39610

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.fitnesse:fitnesse	< 20241026	20241026

Details

As written in the advisory (Markdown source, shown as plain text).

Cross-site scripting vulnerability exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-39610 advisory
https://fitnesse.org/FitNesseDownload web
https://github.com/unclebob/fitnesse package
https://github.com/unclebob/fitnesse/releases/tag/20241026 web
https://jvn.jp/en/jp/JVN36791327 web