CVE Feed

    Dashboard / CVE / CVE-2024-28211

    CVE-2024-28211

    nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMI registry by remote attacker.

    Published:Mar 7, 2024
    Last Modified:May 7, 2025
    EPS:Mar 7, 2024
    EPSS Score:0.0218
    CVSS Score:9.8

    Affected Products

    Vendor
    Naver
    Product
    Ngrinder

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-586 Object Injection

    Related CVEs

    CVE-2024-28216 (CVSS 5.4) — nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access contr…
    CVE-2024-28215 (CVSS 7.5) — nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access contr…
    CVE-2024-28214 (CVSS 2.7) — nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by…
    CVE-2024-28213 (CVSS 9.8) — nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow r…
    CVE-2024-28212 (CVSS 9.8) — nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary co…
    CVE-2016-5060 (CVSS 6.1) — Multiple cross-site scripting (XSS) vulnerabilities in nGrinder before 3.4 allow remote attackers to inject ar…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High