Vulnerability · Published Mar 20, 2024 · Assigned by ProgressSoftware
CVE-2024-1856Progress Telerik Reporting Remote Deserialization Vulnerability
High 8.5
In plain English
A high-severity unsafe deserialization in Telerik Reporting from Progress Software Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities).
Severity (CVSS 3.1)8.5High
Exploit odds (30 days)1.1%top 33.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In Progress® Telerik® Reporting versions prior to 2024 Q1 (18.0.24.130), a code execution attack is possible by a remote threat actor through an insecure deserialization vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Progress Software Corporation | Telerik Reporting | Q1 2007 – before 2024 Q1 (18.0.24.130) |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H