CVE Feed

    Dashboard / CVE / CVE-2024-28215

    CVE-2024-28215

    nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause of information disclosure and limited Server-Side Request Forgery.

    Published:Mar 7, 2024
    Last Modified:May 7, 2025
    EPS:Mar 7, 2024
    EPSS Score:0.00329
    CVSS Score:7.5

    Affected Products

    Vendor
    Naver
    Product
    Ngrinder

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-862 Missing Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2024-28216 (CVSS 5.4) — nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access contr…
    CVE-2024-28214 (CVSS 2.7) — nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by…
    CVE-2024-28213 (CVSS 9.8) — nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow r…
    CVE-2024-28212 (CVSS 9.8) — nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary co…
    CVE-2024-28211 (CVSS 9.8) — nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of ex…
    CVE-2016-5060 (CVSS 6.1) — Multiple cross-site scripting (XSS) vulnerabilities in nGrinder before 3.4 allow remote attackers to inject ar…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High