Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1qN2ptLThnZjUtZnJjbc4AA50O
nGrinder vulnerable to unsafe Java objects deserialization
nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization.
Permalink: https://github.com/advisories/GHSA-j7jm-8gf5-frcmJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qN2ptLThnZjUtZnJjbc4AA50O
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 2 months ago
Updated: about 2 months ago
Identifiers: GHSA-j7jm-8gf5-frcm, CVE-2024-28213
References:
- https://nvd.nist.gov/vuln/detail/CVE-2024-28213
- https://cve.naver.com/detail/cve-2024-28213.html
- https://github.com/naver/ngrinder/commit/85efa4a075354e077a700262ef78e2e9119881bf
- https://github.com/advisories/GHSA-j7jm-8gf5-frcm
Blast Radius: 0.0
Affected Packages
maven:org.ngrinder:ngrinder-core
Dependent packages: 0Dependent repositories: 11
Downloads:
Affected Version Ranges: < 3.5.9
Fixed in: 3.5.9
All affected versions: 3.5.2, 3.5.3, 3.5.4, 3.5.5, 3.5.6, 3.5.7, 3.5.8
All unaffected versions: 3.5.9