CVE-2024-28213
published 2024-03-07CVE-2024-28213: nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via…
PriorityP259critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.20%
64.3th percentile
nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| naver | ngrinder | < 3.5.9 | 3.5.9 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
nGrinder vulnerable to unsafe Java objects deserialization
ghsa·2024-03-07
CVE-2024-28213 [CRITICAL] CWE-502 nGrinder vulnerable to unsafe Java objects deserialization
nGrinder vulnerable to unsafe Java objects deserialization
nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization.
OSV
nGrinder vulnerable to unsafe Java objects deserialization
osv·2024-03-07
CVE-2024-28213 [CRITICAL] nGrinder vulnerable to unsafe Java objects deserialization
nGrinder vulnerable to unsafe Java objects deserialization
nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-03-07
Published