Arbitrary Script Execution Vulnerability in FitNesse Releases
CVE-2024-28128

6.1MEDIUM

Key Information:

Vendor: Unclebob
Status: Fitnesse
Vendor: CVE Published:; 18 March 2024

What is CVE-2024-28128?

Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product and accessing a link with a specially crafted certain parameter.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

FitNesse releases prior to 20220319

References

https://github.com/unclebob/fitnesse

http://fitnesse.org/FitNesseDownload

https://github.com/unclebob/fitnesse/blob/master/SECURITY.md

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
Mar 18, 2024
Vulnerability Reserved
Mar 6, 2024

JSON

Unclebob