by Kastro
Paper/Archive/CVE-2024-8015

CVE-2024-8015

Progress Software Telerik Reporting — Telerik Report Server Insecure Type Resolution

EPSS 0.8%CVSS 9.1
critical.is priorityof 100
39
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 57.4.574 × 2011.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability.

Affected

ProductAffectedFixed inSource
Telerik Reporting1.0.0.0 – < 10.2.24.92410.2.24.924CNA
telerik_reporting1.0.0.0 – < 10.2.24.92410.2.24.924CISA-ADP

Scores by source

ProgressSoftware (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorydocs.telerik.com/report-server/knowledge-base/insecure-type-resolution-cve-2024-8015