
Cloud Vulnerability DB
A community-led vulnerabilities database
CVE-2024-28125 affects FitNesse (all releases), allowing a remote authenticated attacker to execute arbitrary OS commands. The vulnerability was initially reported in March 2024, and its status is currently disputed as a contributor of FitNesse has claimed that this is not a vulnerability but rather a product specification (NVD, JVN).
The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and CWE-77 (Improper Neutralization of Special Elements used in a Command) (NVD).
If exploited, this vulnerability could allow an authenticated attacker to execute arbitrary operating system commands on the affected system, potentially leading to complete system compromise (JVN).
FitNesse's security policy recommends several safety measures: run FitNesse in a secure sandboxed development environment, make it available only to trusted team members, avoid exposing it on public-facing servers, prevent access to production environments, and use the -lh command line argument when running locally to accept only local connections (SECURITY).
The vulnerability is currently under dispute as a FitNesse contributor has stated that the reported behavior is not a vulnerability but rather a product specification. This claim is currently under further investigation (NVD).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."