{"id":"CVE-2024-42499","aliases":["EUVD-2024-3297","GHSA-q297-5ff8-hc92"],"status":"published","title":"FitNesse Path Traversal","description":"Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an attacker may be able to know whether a file exists at a specific path, and/or obtain some part of the file contents under specific conditions.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00667,"percentile":0.52139,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2024-11-15T05:26:23Z","modified":"2026-10-28T02:31:12Z","fixes":[{"ecosystem":"Maven","package":"org.fitnesse:fitnesse","fixed_in":["20241026"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.fitnesse:fitnesse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20241026"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.fitnesse:fitnesse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20241026"}]}],"versions":["20050731","20060719","20070619","20080702","20080812","20081201","20111025","20121220","20130530","20130531","20131109","20131110","20140201","20140418","20140623","20140630","20140901","20150114","20150226","20150424","20150814","20151230","20160515","20160618","20161106","20171210","20171212","20180127","20181221","20181223","20181224","20190110","20190118","20190119","20190127","20190202","20190216","20190224","20190406","20190409","20190416","20190417","20190418","20190421","20190428","20190508","20190620","20190628","20190716","20191110","20191217","20191229","20200108","20200128","20200205","20200304","20200307","20200308","20200404","20200501","20201213","20210410","20210516","20210605","20210606","20211006","20211030","20220319","20220815","20221102","20221219","20230503","20231029","20231203","20240219","20240707","20241023"]}],"products":[{"vendor":"fitnesse","product":"fitnesse"},{"vendor":"unclebob","product":"fitnesse"}],"references":[{"url":"https://github.com/unclebob/fitnesse/releases/tag/20241026","tags":["web"]},{"url":"https://fitnesse.org/FitNesseDownload","tags":["web"]},{"url":"https://jvn.jp/en/jp/JVN36791327/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42499","tags":["advisory"]},{"url":"https://jvn.jp/en/jp/JVN36791327","tags":["web"]},{"url":"https://github.com/unclebob/fitnesse/commit/850c599e5177d6f877af063374086f3e36b4b956","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q297-5ff8-hc92"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42499.json","tags":["advisory"]},{"url":"https://github.com/unclebob/fitnesse","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-42499","description":"Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an attacker may be able to know whether a file exists at a specific path, and/or obtain some part of the file contents under specific conditions.","status":"published","published":"2024-11-15T05:26:23.645Z","modified":"2024-11-18T15:17:46.23Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:03.00063Z"}],"euvd":[{"id":"EUVD-2024-3297","description":"Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an attacker may be able to know whether a file exists at a specific path, and/or obtain some part of the file contents under specific conditions.","status":"published","published":"2024-11-15T05:26:23Z","modified":"2024-11-18T15:17:46Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:57.054288Z"}],"ghsa":[{"id":"GHSA-q297-5ff8-hc92","title":"FitNesse Path Traversal","description":"Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an attacker may be able to know whether a file exists at a specific path, and/or obtain some part of the file contents under specific conditions.","status":"published","published":"2024-11-15T06:30:33Z","modified":"2024-11-18T21:03:35Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:38:20.833758Z"}],"nvd":[{"id":"CVE-2024-42499","description":"Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an attacker may be able to know whether a file exists at a specific path, and/or obtain some part of the file contents under specific conditions.","status":"published","published":"2024-11-15T06:15:04.933Z","modified":"2026-06-17T07:49:34.047Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:10:37.281254Z"}],"osv":[{"id":"CVE-2024-42499","description":"Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an attacker may be able to know whether a file exists at a specific path, and/or obtain some part of the file contents under specific conditions.","status":"published","published":"2024-11-15T05:26:23.645Z","modified":"2026-10-28T02:31:12.509087567Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:42.322107Z"},{"id":"GHSA-q297-5ff8-hc92","title":"FitNesse Path Traversal","description":"Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an attacker may be able to know whether a file exists at a specific path, and/or obtain some part of the file contents under specific conditions.","status":"published","published":"2024-11-15T06:30:33Z","modified":"2024-11-18T21:12:17.556419Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:53.700556Z"}]}}