Paper/Archive/CVE-2024-28213

CVE-2024-28213

NAVER nGrinder — nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute a…

EPSS 1%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 67.9.679 × 2013.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization.

Affected

ProductAffectedFixed inSource

nGrindersee advisory3.5.9CNA

ngrinder< 3.5.93.5.9CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcve.naver.com/detail/cve-2024-28213.html