CVE-2024-39610

6.1 mediumEPSS 0.4%

Medium (6.1) in cleancoder fitnesse. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in org.fitnesse:fitnesse 20241026.

Cross-site scripting vulnerability exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2024-11-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

cleancoder:fitnesse

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-pg82-9w35-3w3r	Maven	org.fitnesse:fitnesse	<20241026	20241026

References

https://fitnesse.org/FitNesseDownload
https://github.com/unclebob/fitnesse/releases/tag/20241026
https://jvn.jp/en/jp/JVN36791327/

Check your stack JSON