PT-2024-29992 · Fitnesse · Fitnesse

Takeshi Kaneko · Published 2024-11-15 · Updated 2024-11-18 · CVE-2024-42499

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FitNesse versions prior to 20241026

Description A Path Traversal issue exists due to improper limitation of a pathname to a restricted directory. If exploited, an attacker may be able to determine whether a file exists at a specific path and/or obtain some part of the file contents under specific conditions.

Recommendations For versions prior to 20241026, update to a version released on or after 20241026 to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-42499

GHSA-Q297-5FF8-HC92

Affected Products

Fitnesse

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-42499 · Security Note
• https://osv.dev/vulnerability/GHSA-q297-5ff8-hc92 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-42499 · Vendor Advisory
• https://github.com/unclebob/fitnesse · Note
• https://github.com/unclebob/fitnesse/releases/tag/20241026 · Note
• https://github.com/unclebob/fitnesse/commit/850c599e5177d6f877af063374086f3e36b4b956 · Note
• https://t.me/cvedetector/11043 · Telegram Post
• https://twitter.com/CVEnew/status/1857352296952418501 · Twitter Post
• https://t.me/cvenotify/101789 · Telegram Post
• https://jvn.jp/en/jp/JVN36791327 · Note
• https://fitnesse.org/FitNesseDownload · Note
• https://twitter.com/VulmonFeeds/status/1857407393719521676 · Twitter Post