com.elega9t:fitnesse-params (=0.0.1), com.github.andreptb:fitnesse-maven-runner-plugin (>=0.2.0 <=0.2.1) +69 more potentially affected by CVE-2024-28125 via org.fitnesse:fitnesse (>=20050731 <=20240707)

org.fitnesse:fitnesse MAVEN version =20050731, =0.2.0, =0.1.0, =BETA-V1.00, =1.0.6, =1.0.0, =1.0.0, =1.2.1, =1.0.1, =1.1.0, =1.0.0, =1.0.0, =1.6.0, =1.6.5 and more Source cves: CVE-2024-28125 Source advisory: OSV:GHSA-X9R9-48RM-4XM6...

CVE-2024-28125

FitNesse (CVE-2024-28125) is affected by command injection due to improper validation of user-supplied input, enabling a remote authenticated attacker to execute arbitrary OS commands. This aligns with multiple sources describing OS command execution in FitNesse and identifies the vulnerable comp...

CVE-2024-28125

FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands. Note: A contributor of FitNesse has claimed that this is not a vulnerability but a product specification and this is currently under further investigation...