Lucene search

ProgressSoftwareVULNRICHMENT:CVE-2024-6327

HistoryJul 24, 2024 - 1:57 p.m.

CVE-2024-6327 Progress Telerik Report Server Deserialization

2024-07-2413:57:07

CWE-502

ProgressSoftware

github.com

cve-2024-6327

progress telerik

report server

deserialization

remote code execution

vulnerability

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

7.8

Confidence

Low

EPSS

0.001

Percentile

31.3%

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

In Progress® Telerik® Report Server versions prior to 2024 Q2 (10.1.24.709), a remote code execution attack is possible through an insecure deserialization vulnerability.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:progress:telerik_reporting:*:*:*:*:*:*:*:*"
    ],
    "vendor": "progress",
    "product": "telerik_reporting",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "10.1.24.709",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

docs.telerik.com/report-server/knowledge-base/deserialization-vulnerability-cve-2024-6327

www.telerik.com/report-server

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

7.8

Confidence

Low

EPSS

0.001

Percentile

31.3%

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Related for VULNRICHMENT:CVE-2024-6327