FitNesse Multiple Vulnerabilities: XSS (CVE-2024-39610) and Path Traversal (CVE-2024-42499)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability ID: JVN#36791327 2. Vulnerability Name: Multiple vulnerabilities in FitNesse 3. Affected Products: FitNesse releases prior to 20241026 4. Vulnerability Description: - Cross-site scripting (CWE-79): CVSS Base Score 6.1, CVE-2024-39610 - Path traversal (CWE-22): CVSS Base Score 5.3, CVE-2024-42499 5. Impact: - Arbitrary scripts may be executed in the browsers of users who use the product (CVE-2024-39610) - Attackers may, under specific conditions, determine whether a file exists and/or obtain partial contents of the file (CVE-2024-42499) 6. Solution: Update the software to the latest version (FitNesse release 20241026) 7. Vendor Status: - Vendor: unclebob - Link: Release 20241026 / fitnesse · GitHub - Official Release: FitNess Official release 8. Reference Links: - JPCERT/CC Addendum - Vulnerability Analysis by JPCERT/CC - Credit: Takeshi Kaneko of GMO Cybersecurity by Ierae, Inc. reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. 9. Additional Information: - JPCERT Alert - JPCERT Reports - CERT Advisory - CPNI Advisory - TRnotes - CVEs: CVE-2024-39610, CVE-2024-42499 - JVN iPedia: JVNDB-2024-000119 This information provides a detailed description of the FitNesse vulnerabilities, their impact, mitigation steps, and relevant reference links.

Goal Reached Thanks to every supporter — we hit 100%!

FitNesse Multiple Vulnerabilities: XSS (CVE-2024-39610) and Path Traversal (CVE-2024-42499)