high7.5Public exploit code
CVE-2014-1216
Improper Neutralization of Special Elements used in a Command in FitNesse Wiki
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Fitnesse Wiki - Remote Command Execution (Metasploit)2014-03-28 · remote · windows · Verified
Impact
FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RUNNER in the pageContent parameter when editing a page.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.fitnesse:fitnesse | >= 20131110, < 20140418 | 20140418 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fitnesse | Fitnesse Wiki | through 20140201 Version 20131110 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://secpod.org/blog/?p=2311
- http://www.exploit-db.com/exploits/32568
- https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1216/
- https://github.com/advisories/GHSA-mpx3-mx2p-9gv3
- https://nvd.nist.gov/vuln/detail/CVE-2014-1216