CVE Feed

    Dashboard / CVE / CVE-2024-28213

    CVE-2024-28213

    nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization.

    Published:Mar 7, 2024
    Last Modified:May 7, 2025
    EPS:Mar 7, 2024
    EPSS Score:0.07048
    CVSS Score:9.8

    Affected Products

    Vendor
    Naver
    Product
    Ngrinder

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-586 Object Injection

    Related CVEs

    CVE-2024-28216 (CVSS 5.4) — nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access contr…
    CVE-2024-28215 (CVSS 7.5) — nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access contr…
    CVE-2024-28214 (CVSS 2.7) — nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by…
    CVE-2024-28212 (CVSS 9.8) — nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary co…
    CVE-2024-28211 (CVSS 9.8) — nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of ex…
    CVE-2016-5060 (CVSS 6.1) — Multiple cross-site scripting (XSS) vulnerabilities in nGrinder before 3.4 allow remote attackers to inject ar…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High