CVE-2024-28213

2024-03-0704:49:47

CWE-502

naver

github.com

ngrinder

unauthenticated users

serialized java objects

remote code execution

cve-2024-28213

AI Score

8.1

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:naver:ngrinder:*:*:*:*:*:*:*:*"
    ],
    "vendor": "naver",
    "product": "ngrinder",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "3.5.9",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]