Unsafe Deserialization Vulnerability in nGrinder Could Allow Remote Code Execution
CVE-2024-28212

9.8CRITICAL

Key Information:

Vendor

Naver

Status
Ngrinder
Vendor
CVE Published:
7 March 2024

What is CVE-2024-28212?

nGrinder prior to version 3.5.9 is affected by a vulnerability stemming from the use of an outdated version of SnakeYAML. This issue can be exploited by remote attackers to execute arbitrary code through unsafe deserialization, posing significant security risks to systems utilizing this software.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

nGrinder 3.5.9

References

https://cve.naver.com/detail/cve-2024-28212.html

EPSS Score

7% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Stöckli of GitHub Security Lab
JSON
.