CVE-2024-4358

Published: May 29, 2024Modified: Jun 17, 2026CISA KEV

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

Affected (1)

Products: Telerik: Report Server 2024

Telerik

1 product

Report Server 2024

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Telerik Report Server 2024	Up to 10.0.24.305

Related CWEs

CWE-290

Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

References (3)

https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358

Source: security@progress.com

MitigationVendor Advisory

https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationVendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4358

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.