CVE-2024-4358 Registration Authentication Bypass Vulnerability

2024-05-2914:51:21

CWE-290

ProgressSoftware

github.com

cve-2024-4358

progress telerik report server

authentication bypass vulnerability

iis

unauthenticated attacker

restricted functionality

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.3 High

AI Score

Confidence

Low

0.938 High

EPSS

Percentile

99.2%

JSON

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows"
    ],
    "product": "Telerik Report Server",
    "vendor": "Progress Software Corporation",
    "versions": [
      {
        "lessThan": "10.1.24.514",
        "status": "affected",
        "version": "1.0.0",
        "versionType": "semver"
      }
    ]
  }
]