CVE-2024-4357

Published: May 15, 2024Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

An information disclosure vulnerability exists in Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, allows low-privilege attacker to read systems file via XML External Entity Processing.

Affected (1)

Products: Progress: Telerik Reporting

Progress

1 product

Telerik Reporting

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Progress Telerik Reporting	Before 10.1.24.514

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (2)

https://docs.telerik.com/report-server/knowledge-base/xxe-vulnerability-cve-2024-4357

Source: security@progress.com

Vendor Advisory

https://docs.telerik.com/report-server/knowledge-base/xxe-vulnerability-cve-2024-4357

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.