CVE-2024-28125: 
Java vulnerability analysis and mitigation

CVE-2024-28125 affects FitNesse (all releases), allowing a remote authenticated attacker to execute arbitrary OS commands. The vulnerability was initially reported in March 2024, and its status is currently disputed as a contributor of FitNesse has claimed that this is not a vulnerability but rather a product specification (NVD, JVN).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and CWE-77 (Improper Neutralization of Special Elements used in a Command) (NVD).

If exploited, this vulnerability could allow an authenticated attacker to execute arbitrary operating system commands on the affected system, potentially leading to complete system compromise (JVN).

The vulnerability requires authentication for exploitation, but has low attack complexity and requires no user interaction. The attack vector is network-based, indicating remote exploitation is possible (NVD).

FitNesse's security policy recommends several safety measures: run FitNesse in a secure sandboxed development environment, make it available only to trusted team members, avoid exposing it on public-facing servers, prevent access to production environments, and use the -lh command line argument when running locally to accept only local connections (SECURITY).

The vulnerability is currently under dispute as a FitNesse contributor has stated that the reported behavior is not a vulnerability but rather a product specification. This claim is currently under further investigation (NVD).