Improper Neutralization of Special Elements used in a Command in FitNesse Wiki

HIGH 7.5CVE-2014-1216 · GHSA-mpx3-mx2p-9gv3 · Published 22/04/2014 · updated 17/06/2026

In short

CVE-2014-1216 is a HIGH (CVSS 7.5) vulnerability affecting org.fitnesse:fitnesse, fitnesse wiki (fitnesse).
Chance of exploitation in the next 30 days (EPSS): 3.7%, higher than 89.9% of all vulnerabilities.
Fix: update to 20140418 or later.

Package	Affected versions	Patched versions
org.fitnesse:fitnesse Maven	`≥ 20131110, < 20140418`	`20140418`
fitnesse wiki fitnesse	`= 20131110≤ 20140201`	No fix yet

Description

FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RUNNER in the pageContent parameter when editing a page.

NVD description

FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RUNNER in the pageContent parameter when editing a page.

References

nvd.nist.gov/vuln/detail/CVE-2014-1216 · ADVISORY
exploit-db.com/exploits/32568 · WEB
secpod.org/blog
portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1216 · Exploit

More vulnerabilities in org.fitnesse:fitnesse

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.fitnesse:fitnesse

Maven

≥ 20131110, < 20140418

20140418

fitnesse wiki

fitnesse

= 20131110≤ 20140201

No fix yet

Description

FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RUNNER in the pageContent parameter when editing a page.

NVD description

FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RUNNER in the pageContent parameter when editing a page.

More vulnerabilities in org.fitnesse:fitnesse

See all →