CVE-2024-28213

2024-03-0705:15:54

CWE-502

naver

web.nvd.nist.gov

ngrinder

cve-2024-28213

remote code execution

java deserialization

security vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.1

Confidence

Low

EPSS

Percentile

9.0%

JSON

nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization.

CNA Affected

[
  {
    "vendor": "NAVER",
    "product": "nGrinder",
    "versions": [
      {
        "status": "unaffected",
        "version": "3.5.9"
      }
    ],
    "defaultStatus": "affected"
  }
]