Read the docs
TI-2024-18781 Aliases CVE-2024-28215GHSA-xj7p-j38q-7pq6

Missing authorization in NAVER nGrinder

Priority MEDIUM 40CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-862.

Summary

nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause of information disclosure and limited Server-Side Request Forgery.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00547 46th percentileScored 2026-11-07
Fix Fixed nGrinder (NAVER): 3.5.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NAVERnGrinder—3.5.9Patch availableCNA
  • nGrinder VendorNAVER Affected — Fixed in 3.5.9 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:naver:ngrinder:*:*:*:*:*:*:*:*before 3.5.9VulnerableNAVER
  • cpe:2.3:a:naver:ngrinder:*:*:*:*:*:*:*:* Versions before 3.5.9 Vulnerable ·NAVER

Remediation

  • Fix · CNA nGrinder (NAVER) Fixed in 3.5.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-28215
  2. 2026-10-03 Alias added: GHSA-xj7p-j38q-7pq6

References

Advisory 1

  • TI-2024-18782 Missing authorization in NAVER nGrinder CVSS 3.1MEDIUM 5.4
  • TI-2024-18778 Deserialization of untrusted data in NAVER nGrinder CVSS 3.1CRITICAL 9.8
  • TI-2024-18777 Deserialization of untrusted data in NAVER nGrinder CVSS 3.1CRITICAL 9.8
  • TI-2024-18779 Deserialization of untrusted data in NAVER nGrinder CVSS 3.1CRITICAL 9.8
  • TI-2016-04378 Multiple cross-site scripting (XSS) vulnerabilities in nGrinder before 3.4 allow remote… CVSS 3.0MEDIUM 6.1
  • TI-2024-18780 nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of… CVSS 3.1LOW 2.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences