TI-2014-00929 Aliases CVE-2014-1216 GHSA-mpx3-mx2p-9gv3

FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute…

LOW 39CWE-77Published 2014-04-21 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: Partial · Partial · Partial
Fix status: Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RUNNER in the pageContent parameter when editing a page.

Why it matters now

EPSS 0.03732 89th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by the CNA and NVD

Fix Fixed org.fitnesse:fitnesse (Maven): 20140418

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	org.fitnesse:fitnesse (Maven)	20131110 to before 20140418	20140418	Patch available	GHSA-mpx3-mx2p-9gv3

— Vendor— Affected all versions Fixed in — No fix listed CNA
org.fitnesse:fitnesse (Maven) Vendor— Affected 20131110 to before 20140418 Fixed in 20140418 Patch available GHSA-mpx3-mx2p-9gv3

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:fitnesse:fitnesse_wiki::::::::	up to 20140201	Vulnerable	Fitnesse
cpe:2.3:a:fitnesse:fitnesse_wiki:20131110:::::::*	20131110	Vulnerable	Fitnesse

cpe:2.3:a:fitnesse:fitnesse_wiki:*:*:*:*:*:*:*:* Versions up to 20140201 Vulnerable ·Fitnesse
cpe:2.3:a:fitnesse:fitnesse_wiki:20131110:*:*:*:*:*:*:* Versions 20131110 Vulnerable ·Fitnesse

Remediation

Fix · GHSA-mpx3-mx2p-9gv3 org.fitnesse:fitnesse (Maven) Fixed in 20140418 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2014-1216
2026-10-03 Alias added: GHSA-mpx3-mx2p-9gv3
2026-10-04 EPSS moved to the 50th–90th percentile
2026-10-04 Priority changed: MEDIUM → LOW

References

Exploit 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2014-1216

Other 1

http://secpod.org/blog/?p=2311

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences