FitNesse All Releases Vulnerable to Remote OS Command Execution

CVE-2024-28125

What is CVE-2024-28125?

The FitNesse framework, developed by Uncle Bob, is susceptible to a vulnerability that permits remote authenticated attackers to execute arbitrary operating system commands. This issue has been noted across all releases of the product. Although a contributor contends that this behavior aligns with product specifications, it remains the subject of ongoing scrutiny. Users of FitNesse are urged to stay informed about potential impacts and seek mitigations to ensure the security of their applications.

References