nGrinder vulnerabilities

3 known vulnerabilities in nGrinder from NAVER. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  nGrinder: Missing Authorization

  CVE-2024-28215Mar 7, 2024NAVER

  nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause of information disclosure and limited Server-Side Request Forgery.

• 9.8 Critical severity

  nGrinder: Deserialization of Untrusted Data

  CVE-2024-28213Mar 7, 2024NAVEREPSS 1.19%

  nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization.

• 9.8 Critical severity

  nGrinder: Deserialization of Untrusted Data

  CVE-2024-28211Mar 7, 2024NAVER

  nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMI registry by remote attacker.