Open-source package vulnerability · Maven
CVE-2024-28125: FitNesse allows execution of arbitrary OS commands
criticalCVSS 4.0 9.3 · 3.1 9.8GHSA-x9r9-48rm-4xm6
FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands.
Published Mar 18, 2024 · Updated Sep 19, 2025
Affected packages
org.fitnesse:fitnesse
- Ecosystem
- Maven
- Affected
- <= 20240707
- Fixed in
- No patched version yet
- Check
mvn dependency:tree -Dincludes=org.fitnesse:fitnesse
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology