CVE-2024-42499: FitNesse Path Traversal

November 15, 2024 (updated November 18, 2024)

Improper limitation of a pathname to a restricted directory (‘Path Traversal’) issue exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an attacker may be able to know whether a file exists at a specific path, and/or obtain some part of the file contents under specific conditions.

References

fitnesse.org/FitNesseDownload
github.com/advisories/GHSA-q297-5ff8-hc92
github.com/unclebob/fitnesse
github.com/unclebob/fitnesse/commit/850c599e5177d6f877af063374086f3e36b4b956
github.com/unclebob/fitnesse/releases/tag/20241026
jvn.jp/en/jp/JVN36791327
nvd.nist.gov/vuln/detail/CVE-2024-42499

Code Behaviors & Features

Detect and mitigate CVE-2024-42499 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →