Unsafe Deserialization Vulnerability in nGrinder Could Allow Remote Code Execution
CVE-2024-28212

9.8CRITICAL

Key Information:

Vendor

Naver

Status
Ngrinder
Vendor
CVE Published:
7 March 2024

What is CVE-2024-28212?

nGrinder prior to version 3.5.9 is affected by a vulnerability stemming from the use of an outdated version of SnakeYAML. This issue can be exploited by remote attackers to execute arbitrary code through unsafe deserialization, posing significant security risks to systems utilizing this software.

Affected Version(s)

nGrinder 3.5.9

References

https://cve.naver.com/detail/cve-2024-28212.html

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Stöckli of GitHub Security Lab
.