Lucene search

NaverCVELIST:CVE-2024-28213

HistoryMar 07, 2024 - 4:49 a.m.

CVE-2024-28213

2024-03-0704:49:47

CWE-502

naver

www.cve.org

ngrinder

serialization

vulnerability

remote attacker

arbitrary code

deserialization

AI Score

8.1

Confidence

Low

EPSS

Percentile

9.0%

JSON

nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization.

CNA Affected

[
  {
    "vendor": "NAVER",
    "product": "nGrinder",
    "versions": [
      {
        "status": "unaffected",
        "version": "3.5.9"
      }
    ],
    "defaultStatus": "affected"
  }
]

References

cve.naver.com/detail/cve-2024-28213.html