CVE-2024-28039

2024-03-1809:15:06

[email protected]

web.nvd.nist.gov

cve-2024-28039

fitnesse

xml

entity

vulnerability

remote attacker

unauthenticated

sensitive information

alter data

denial-of-service

dos

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

Improper restriction of XML external entity references vulnerability exists in FitNesse all releases, which allows a remote unauthenticated attacker to obtain sensitive information, alter data, or cause a denial-of-service (DoS) condition.

References

fitnesse.org/FitNesseDownload

github.com/unclebob/fitnesse

github.com/unclebob/fitnesse/blob/master/SECURITY.md

jvn.jp/en/jp/JVN94521208/