Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1qN2ptLThnZjUtZnJjbc4AA50O

nGrinder vulnerable to unsafe Java objects deserialization

nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization.

Permalink: https://github.com/advisories/GHSA-j7jm-8gf5-frcm
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qN2ptLThnZjUtZnJjbc4AA50O
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: 9 months ago
Updated: 3 months ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-j7jm-8gf5-frcm, CVE-2024-28213
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-28213
• https://cve.naver.com/detail/cve-2024-28213.html
• https://github.com/naver/ngrinder/commit/85efa4a075354e077a700262ef78e2e9119881bf
• https://github.com/advisories/GHSA-j7jm-8gf5-frcm

Repository: https://github.com/naver/ngrinder
Blast Radius: 10.2

Affected Packages