CVE-2024-4358

Summary

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

Affected Software

Weaknesses

• CWE-290: CWE-290 Authentication Bypass by Spoofing

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: active
  • Automatable: yes
  • Technical Impact: total

Additional References

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4358

CVE Program Container

Additional References

• https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358

References

• https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358

• ←Previous
• Next→