Actively exploited · Published May 29, 2024 · Assigned by ProgressSoftware
CVE-2024-4358Registration Authentication Bypass Vulnerability
Critical 9.8 Exploited
In plain English
A critical-severity authentication bypass by spoofing in Telerik Report Server from Progress Software Corporation. Attackers are actively exploiting it in the wild (listed by CISA on June 13, 2024). The chance it is exploited in the next 30 days is estimated at 97.5% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Jul 4, 2024.
Official description
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Progress Software Corporation | Telerik Report Server | 1.0.0 – before 10.1.24.514 |
Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H