Read the docs
TI-2024-18779 Aliases CVE-2024-28213GHSA-j7jm-8gf5-frcm

Deserialization of untrusted data in NAVER nGrinder

Priority MEDIUM 45CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via unsafe Java objects deserialization.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01189 68th percentileScored 2026-11-07
Fix Fixed nGrinder (NAVER): 3.5.9org.ngrinder:ngrinder-core (Maven): 3.5.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NAVERnGrinder—3.5.9Patch availableCNA
—org.ngrinder:ngrinder-core (Maven)before 3.5.93.5.9Patch availableGHSA-j7jm-8gf5-frcm
  • nGrinder VendorNAVER Affected — Fixed in 3.5.9 Patch available CNA
  • org.ngrinder:ngrinder-core (Maven) Vendor— Affected before 3.5.9 Fixed in 3.5.9 Patch available GHSA-j7jm-8gf5-frcm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:naver:ngrinder:*:*:*:*:*:*:*:*before 3.5.9VulnerableNAVER
  • cpe:2.3:a:naver:ngrinder:*:*:*:*:*:*:*:* Versions before 3.5.9 Vulnerable ·NAVER

Remediation

  • Fix · CNA nGrinder (NAVER) Fixed in 3.5.9
  • Fix · GHSA-j7jm-8gf5-frcm org.ngrinder:ngrinder-core (Maven) Fixed in 3.5.9 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-28213
  2. 2026-10-03 Alias added: GHSA-j7jm-8gf5-frcm

References

Advisory 2

Other 2

  • TI-2024-18782 Missing authorization in NAVER nGrinder CVSS 3.1MEDIUM 5.4
  • TI-2024-18778 Deserialization of untrusted data in NAVER nGrinder CVSS 3.1CRITICAL 9.8
  • TI-2024-18777 Deserialization of untrusted data in NAVER nGrinder CVSS 3.1CRITICAL 9.8
  • TI-2024-18781 Missing authorization in NAVER nGrinder CVSS 3.1HIGH 7.5
  • TI-2016-04378 Multiple cross-site scripting (XSS) vulnerabilities in nGrinder before 3.4 allow remote… CVSS 3.0MEDIUM 6.1
  • TI-2024-18780 nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of… CVSS 3.1LOW 2.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences