{"id":"CVE-2024-28125","aliases":["EUVD-2024-1037","GHSA-x9r9-48rm-4xm6"],"status":"disputed","title":"FitNesse allows execution of arbitrary OS commands","description":"FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands. Note: A contributor of FitNesse has claimed that this is not a vulnerability but a product specification and this is currently under further investigation.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00992,"percentile":0.6299,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-77","CWE-78"],"published":"2024-03-18T07:26:21Z","modified":"2026-06-17T07:21:00Z","affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.fitnesse:fitnesse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"20240707"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.fitnesse:fitnesse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"20240707"}]}],"versions":["20050731","20060719","20070619","20080702","20080812","20081201","20111025","20121220","20130530","20130531","20131109","20131110","20140201","20140418","20140623","20140630","20140901","20150114","20150226","20150424","20150814","20151230","20160515","20160618","20161106","20171210","20171212","20180127","20181221","20181223","20181224","20190110","20190118","20190119","20190127","20190202","20190216","20190224","20190406","20190409","20190416","20190417","20190418","20190421","20190428","20190508","20190620","20190628","20190716","20191110","20191217","20191229","20200108","20200128","20200205","20200304","20200307","20200308","20200404","20200501","20201213","20210410","20210516","20210605","20210606","20211006","20211030","20220319","20220815","20221102","20221219","20230503","20231029","20231203","20240219","20240707"]}],"products":[{"vendor":"fitnesse","product":"fitnesse"},{"vendor":"unclebob","product":"fitnesse"}],"references":[{"url":"https://github.com/unclebob/fitnesse","tags":["x_transferred","package"]},{"url":"http://fitnesse.org/FitNesseDownload","tags":["x_transferred","web"]},{"url":"https://github.com/unclebob/fitnesse/blob/master/SECURITY.md","tags":["x_transferred","web"]},{"url":"https://jvn.jp/en/jp/JVN94521208/","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28125","tags":["advisory"]},{"url":"https://jvn.jp/en/jp/JVN94521208","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x9r9-48rm-4xm6"}],"sources":{"cve":[{"id":"CVE-2024-28125","description":"FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands. Note: A contributor of FitNesse has claimed that this is not a vulnerability but a product specification and this is currently under further investigation.","status":"disputed","published":"2024-03-18T07:26:21.298Z","modified":"2025-09-19T17:24:24.131Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:18.597034Z"}],"euvd":[{"id":"EUVD-2024-1037","description":"FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands. Note: A contributor of FitNesse has claimed that this is not a vulnerability but a product specification and this is currently under further investigation.","status":"published","published":"2024-03-18T07:26:21Z","modified":"2025-09-19T17:24:24Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:31:41.254663Z"}],"ghsa":[{"id":"GHSA-x9r9-48rm-4xm6","title":"FitNesse allows execution of arbitrary OS commands","description":"FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands.","status":"published","published":"2024-03-18T09:30:30Z","modified":"2025-09-19T18:33:25Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T14:38:58.107905Z"}],"nvd":[{"id":"CVE-2024-28125","description":"FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands. Note: A contributor of FitNesse has claimed that this is not a vulnerability but a product specification and this is currently under further investigation.","status":"disputed","published":"2024-03-18T08:15:06.347Z","modified":"2026-06-17T07:21:00.947Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:09:41.654534Z"}],"osv":[{"id":"GHSA-x9r9-48rm-4xm6","title":"FitNesse allows execution of arbitrary OS commands","description":"FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands.","status":"published","published":"2024-03-18T09:30:30Z","modified":"2025-09-19T18:54:10.508175Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T15:46:59.835583Z"}]}}