Vulnerability · Published Jan 31, 2024 · Assigned by ProgressSoftware

CVE-2024-0219Privilege Elevation via Telerik JustDecompile Installer

High 7.8

In plain English

A high-severity privilege mismanagement in Telerik JustDecompile from Progress Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 91.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In Telerik JustDecompile versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik JustDecompile install is present, a lower privileged user has the ability to manipulate the installation package to elevate their privileges on the underlying operating system.

Affected products (as reported)

Vendor	Product	Versions
Progress Software	Telerik JustDecompile	RC2012.1 – before 2024 R1

Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://www.telerik.com/products/decompiler.aspx product
https://docs.telerik.com/devtools/justdecompile/knowledge-base/legacy-installer-vulnerability vendor-advisory