CVE-2024-4358
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Analyzed - security@progress.com
- Published
- 2024-05-29
- Last modified
- 2025-10-21
- Known exploited (CISA KEV)
- since 2024-06-13, action due 2024-07-04: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Weaknesses
- CWE-290
Affected products
- Telerik Report Server (Progress Software)
- Telerik Report Server (Progress Software Corporation)
- Report Server 2024 (Telerik)
References
- https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4358
