CVE-2024-4358

CRITICALCISA KEV

9.8

Description

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published5/29/2024

Last Modified10/31/2025

Sourcekev

Honeypot Sightings0

CISA KEV

VendorProgress

ProductTelerik Report Server

Vulnerability NameProgress Telerik Report Server Authentication Bypass by Spoofing Vulnerability

KEV Date Added2024-06-13

Remediation Due Date2024-07-04

Ransomware UseUnknown

Affected Products

telerik:report_server_2024

Weaknesses (CWE)

CWE-290CWE-290

References

https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358(security@progress.com)

https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4358(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.