{"id":"GHSA-mjq8-gg9x-87gr","summary":"FitNesse Cross-site Scripting vulnerability","details":"Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product and accessing a link with a specially crafted certain parameter.","aliases":["CVE-2024-28128"],"modified":"2025-03-21T23:25:47.286661Z","published":"2024-03-18T09:30:31Z","database_specific":{"github_reviewed_at":"2025-03-21T22:28:56Z","nvd_published_at":"2024-03-18T08:15:06Z","cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28128"},{"type":"PACKAGE","url":"https://github.com/unclebob/fitnesse"},{"type":"WEB","url":"https://github.com/unclebob/fitnesse/blob/master/SECURITY.md"},{"type":"WEB","url":"https://jvn.jp/en/jp/JVN94521208"},{"type":"WEB","url":"http://fitnesse.org/FitNesseDownload"}],"affected":[{"package":{"name":"org.fitnesse:fitnesse","ecosystem":"Maven","purl":"pkg:maven/org.fitnesse/fitnesse"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20220319"}]}],"versions":["20050731","20060719","20070619","20080702","20080812","20081201","20111025","20121220","20130530","20130531","20131109","20131110","20140201","20140418","20140623","20140630","20140901","20150114","20150226","20150424","20150814","20151230","20160515","20160618","20161106","20171210","20171212","20180127","20181221","20181223","20181224","20190110","20190118","20190119","20190127","20190202","20190216","20190224","20190406","20190409","20190416","20190417","20190418","20190421","20190428","20190508","20190620","20190628","20190716","20191110","20191217","20191229","20200108","20200128","20200205","20200304","20200307","20200308","20200404","20200501","20201213","20210410","20210516","20210605","20210606","20211006","20211030"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-mjq8-gg9x-87gr/GHSA-mjq8-gg9x-87gr.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}