CVE-2024-28213
CRITICALNaver Ngrinder < 3.5.9 - Insecure Deserialization
Title source: ruleDescription
nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization.
Scores
CVSS v3
9.8
EPSS
0.0705
EPSS Percentile
91.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Classification
CWE
CWE-502
Status
published
Affected Products (2)
naver/ngrinder
< 3.5.9
org.ngrinder/ngrinder-core
< 3.5.9Maven
Timeline
Published
Mar 07, 2024
Tracked Since
Feb 18, 2026