CVE-2024-4358

2024-05-2915:16:06

CWE-290

ProgressSoftware

web.nvd.nist.gov

104

In Wild

106

telerik report server

version 2024

iis

unauthenticated attacker

access

restricted functionality

authentication bypass

vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.931

Percentile

99.1%

JSON

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

Affected configurations

Nvd

Node

telerikreport_server_2024Range≤10.0.24.305

VendorProductVersionCPE
telerikreport_server_2024*cpe:2.3:a:telerik:report_server_2024:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
telerik	report_server_2024	*	cpe:2.3:a:telerik:report_server_2024::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows"
    ],
    "product": "Telerik Report Server",
    "vendor": "Progress Software Corporation",
    "versions": [
      {
        "lessThan": "10.1.24.514",
        "status": "affected",
        "version": "1.0.0",
        "versionType": "semver"
      }
    ]
  }
]