PT-2024-28552 · Fitnesse · Fitnesse

Takeshi Kaneko · Published 2024-11-15 · Updated 2024-11-20 · CVE-2024-39610

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FitNesse versions prior to 20241026

Description A cross-site scripting issue exists, allowing an arbitrary script to be executed on the user's web browser if exploited.

Recommendations For versions prior to 20241026, update to a version released after 20241026 to resolve the issue. As a temporary workaround, consider restricting access to sensitive features or input fields to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-39610

GHSA-PG82-9W35-3W3R

Affected Products

Fitnesse

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-39610 · Security Note
• https://osv.dev/vulnerability/GHSA-pg82-9w35-3w3r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-39610 · Vendor Advisory
• https://github.com/unclebob/fitnesse · Note
• https://github.com/unclebob/fitnesse/releases/tag/20241026 · Note
• https://t.me/cvedetector/11042 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1857417633739493579 · Twitter Post
• https://t.me/cvenotify/101788 · Telegram Post
• https://twitter.com/CVEnew/status/1857352295673196679 · Twitter Post
• https://fitnesse.org/FitNesseDownload · Note
• https://jvn.jp/en/jp/JVN36791327 · Note
• https://t.me/cvenotify/102275 · Telegram Post