CVE-2024-28214
CVE-2024-28214 is a low-severity vulnerability in Naver Ngrinder with a CVSS 3.x base score of 2.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-405.
Key facts
- Severity: Low (CVSS 3.x base score 2.7)
- EPSS exploit prediction: 1% (45th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2024-25332
- Weakness: CWE-405
- Affected product: Naver Ngrinder
- Published:
- Last modified:
Description
nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker.
Frequently asked questions
- What is CVE-2024-28214?
- nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker.
- How severe is CVE-2024-28214?
- CVE-2024-28214 has a CVSS 3.x base score of 2.7, rated low severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
- Is CVE-2024-28214 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (45th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2024-28214?
- CVE-2024-28214 affects Naver Ngrinder. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2024-28214?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2024-28214 have an EU (EUVD) identifier?
- Yes. CVE-2024-28214 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-25332.
- When was CVE-2024-28214 published?
- CVE-2024-28214 was published on 2024-03-07 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:naver:ngrinder:*:*:*:*:*:*:*:*
More vulnerabilities in Naver Ngrinder
- CVE-2024-28213 — Critical (CVSS 9.8): nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote…
- CVE-2024-28212 — Critical (CVSS 9.8): nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via…
- CVE-2024-28211 — Critical (CVSS 9.8): nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing…
- CVE-2024-28215 — High (CVSS 7.5): nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which…
- CVE-2016-5060 — Medium (CVSS 6.1): Multiple cross-site scripting (XSS) vulnerabilities in nGrinder before 3.4 allow remote attackers to inject arbitrary…
- CVE-2024-28216 — Medium (CVSS 5.4): nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access control, which…
All CVEs affecting Naver Ngrinder →
Other CWE-405 vulnerabilities
- CVE-2025-53633 — Critical (CVSS 9.8): Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario…
- CVE-2021-38447 — High (CVSS 8.6): OCI OpenDDS versions prior to 3.18.1 are vulnerable when an attacker sends a specially crafted packet to flood target…
- CVE-2025-42874 — High (CVSS 7.9): SAP NetWeaver remote service for Xcelsius allows an attacker with network access and high privileges to execute…
- CVE-2026-47774 — High (CVSS 7.5): Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11,…
- CVE-2026-25611 — High (CVSS 7.5): A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server.
- CVE-2026-0485 — High (CVSS 7.5): SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause…