by Kastro
Paper/Archive/CVE-2024-4358

CVE-2024-4358

Progress Software Corporation Telerik Report Server — Registration Authentication Bypass Vulnerability

KEV · due 4 JulEPSS 97%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.9.999 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

Affected

ProductAffectedFixed inSource
Telerik Report Server1.0.0 – < 10.1.24.51410.1.24.514CNA
telerik_report_server1.0.0.0 – < 10.1.24.51410.1.24.514CISA-ADP

Scores by source

ProgressSoftware (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refdocs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4358kevcisa.gov/known-exploited-vulnerabilities-catalog