CVE-2024-1800

🗓️ 20 Mar 2024 13:11:41Reported by ProgressSoftwareType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 193 Views🌐 WEB

Insecure deserialization vulnerability in In Progress® Telerik® Report Serve

Reporter	Title	Published	Views	Family All 25
GithubExploit	Exploit for Authentication Bypass by Spoofing in Telerik Report_Server_2024	4 Jun 202416:07	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Telerik Report_Server_2024	3 Jun 202408:22	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Telerik Report_Server_2024	24 Aug 202410:09	–	githubexploit
GithubExploit	Exploit for Authentication Bypass by Spoofing in Telerik Report_Server_2024	24 Aug 202410:09	–	githubexploit
0day.today	Telerik Report Server Authentication Bypass / Remote Code Execution Exploit	13 Jun 202400:00	–	zdt
ATTACKERKB	CVE-2024-4358	29 May 202400:00	–	attackerkb
BDU FSTEC	The vulnerability of the Telerik Report Server’s reporting control software lies in its deserialization mechanism flaws, which allow attackers to execute arbitrary code.	22 Mar 202400:00	–	bdu_fstec
Circl	CVE-2024-1800	21 Mar 202423:00	–	circl
CNNVD	Progress Software Telerik Report Server Code Issue Vulnerability	20 Mar 202400:00	–	cnnvd
Cvelist	CVE-2024-1800 Progress Telerik Report Server Deserialization	20 Mar 202413:11	–	cvelist

NVD

Node

progress telerik_report_serverRange<10.0.24.130

[
  {
    "defaultStatus": "affected",
    "product": "Telerik Report Server",
    "vendor": "Progress Software Corporation",
    "versions": [
      {
        "lessThan": "2024 Q1 (10.0.24.130)",
        "status": "affected",
        "version": "1.00",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
docs	www.docs.telerik.com/report-server/knowledge-base/deserialization-vulnerability-cve-2024-1800
telerik	www.telerik.com/report-server

Parameter	Position	Path	Description	CWE
Username	request body	Startup/Register	Endpoint used to create a new administrator account via CVE-2024-4358 authentication bypass.	CWE-502
Password	request body	Startup/Register	Endpoint used to create a new administrator account via CVE-2024-4358 authentication bypass.	CWE-502
ConfirmPassword	request body	Startup/Register	Endpoint used to create a new administrator account via CVE-2024-4358 authentication bypass.	CWE-502
Email	request body	Startup/Register	Endpoint used to create a new administrator account via CVE-2024-4358 authentication bypass.	CWE-502
FirstName	request body	Startup/Register	Endpoint used to create a new administrator account via CVE-2024-4358 authentication bypass.	CWE-502
LastName	request body	Startup/Register	Endpoint used to create a new administrator account via CVE-2024-4358 authentication bypass.	CWE-502

17 Jun 2026 07:05Current

9.7High risk

Vulners AI Score9.7

CVSS 3.18.8 - 9.9

EPSS0.40375

SSVC