Read the docs
TI-2024-18782 Aliases CVE-2024-28216GHSA-wcmh-ghjh-4j2h

Missing authorization in NAVER nGrinder

Priority MEDIUM 58CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-862.

Summary

nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access control, which could be the cause of information disclosure and limited Server-Side Request Forgery.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00333 26th percentileScored 2026-11-07
Fix Fixed nGrinder (NAVER): 3.5.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NAVERnGrinder—3.5.9Patch availableCNA
  • nGrinder VendorNAVER Affected — Fixed in 3.5.9 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:naver:ngrinder:*:*:*:*:*:*:*:*before 3.5.9VulnerableNAVER
  • cpe:2.3:a:naver:ngrinder:*:*:*:*:*:*:*:* Versions before 3.5.9 Vulnerable ·NAVER

Remediation

  • Fix · CNA nGrinder (NAVER) Fixed in 3.5.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-28216
  2. 2026-10-03 Alias added: GHSA-wcmh-ghjh-4j2h

References

Advisory 1

  • TI-2024-18778 Deserialization of untrusted data in NAVER nGrinder CVSS 3.1CRITICAL 9.8
  • TI-2024-18777 Deserialization of untrusted data in NAVER nGrinder CVSS 3.1CRITICAL 9.8
  • TI-2024-18779 Deserialization of untrusted data in NAVER nGrinder CVSS 3.1CRITICAL 9.8
  • TI-2024-18781 Missing authorization in NAVER nGrinder CVSS 3.1HIGH 7.5
  • TI-2016-04378 Multiple cross-site scripting (XSS) vulnerabilities in nGrinder before 3.4 allow remote… CVSS 3.0MEDIUM 6.1
  • TI-2024-18780 nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of… CVSS 3.1LOW 2.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences