{"id":"CVE-2024-28128","aliases":["EUVD-2024-25275","GHSA-mjq8-gg9x-87gr"],"status":"published","title":"FitNesse Cross-site Scripting vulnerability","description":"Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product and accessing a link with a specially crafted certain parameter.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0057,"percentile":0.47501,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2024-03-18T07:31:34Z","modified":"2026-10-28T02:31:06Z","fixes":[{"ecosystem":"Maven","package":"org.fitnesse:fitnesse","fixed_in":["20220319"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.fitnesse:fitnesse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20220319"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.fitnesse:fitnesse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20220319"}]}],"versions":["20050731","20060719","20070619","20080702","20080812","20081201","20111025","20121220","20130530","20130531","20131109","20131110","20140201","20140418","20140623","20140630","20140901","20150114","20150226","20150424","20150814","20151230","20160515","20160618","20161106","20171210","20171212","20180127","20181221","20181223","20181224","20190110","20190118","20190119","20190127","20190202","20190216","20190224","20190406","20190409","20190416","20190417","20190418","20190421","20190428","20190508","20190620","20190628","20190716","20191110","20191217","20191229","20200108","20200128","20200205","20200304","20200307","20200308","20200404","20200501","20201213","20210410","20210516","20210605","20210606","20211006","20211030"]}],"products":[{"vendor":"cleancoder","product":"fitnesse"},{"vendor":"unclebob","product":"fitnesse"}],"references":[{"url":"https://github.com/unclebob/fitnesse","tags":["x_transferred","Product","package"]},{"url":"http://fitnesse.org/FitNesseDownload","tags":["x_transferred","Product","Release Notes","web"]},{"url":"https://github.com/unclebob/fitnesse/blob/master/SECURITY.md","tags":["x_transferred","Product","web"]},{"url":"https://jvn.jp/en/jp/JVN94521208/","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28128","tags":["advisory"]},{"url":"https://jvn.jp/en/jp/JVN94521208","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mjq8-gg9x-87gr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28128.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-28128","description":"Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product and accessing a link with a specially crafted certain parameter.","status":"published","published":"2024-03-18T07:31:34.749Z","modified":"2025-03-20T19:10:27.895Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:18.597034Z"}],"euvd":[{"id":"EUVD-2024-25275","description":"Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product and accessing a link with a specially crafted certain parameter.","status":"published","published":"2024-03-18T07:31:34Z","modified":"2025-03-20T19:10:27Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:56.973752Z"}],"ghsa":[{"id":"GHSA-mjq8-gg9x-87gr","title":"FitNesse Cross-site Scripting vulnerability","description":"Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product and accessing a link with a specially crafted certain parameter.","status":"published","published":"2024-03-18T09:30:31Z","modified":"2025-03-21T22:28:57Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:36.51789Z"}],"nvd":[{"id":"CVE-2024-28128","description":"Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product and accessing a link with a specially crafted certain parameter.","status":"published","published":"2024-03-18T08:15:06.4Z","modified":"2026-06-17T07:21:01.34Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:09:41.654534Z"}],"osv":[{"id":"CVE-2024-28128","description":"Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product and accessing a link with a specially crafted certain parameter.","status":"published","published":"2024-03-18T07:31:34.749Z","modified":"2026-10-28T02:31:06.304761028Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:39.569658Z"},{"id":"GHSA-mjq8-gg9x-87gr","title":"FitNesse Cross-site Scripting vulnerability","description":"Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product and accessing a link with a specially crafted certain parameter.","status":"published","published":"2024-03-18T09:30:31Z","modified":"2025-03-21T23:25:47.286661Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:51.811331Z"}]}}