Vulnerability · Published Jan 31, 2024 · Assigned by ProgressSoftware

CVE-2024-0832Privilege Elevation via Telerik Reporting Installer

High 7.8

In plain English

A high-severity privilege mismanagement in Telerik Reporting from Progress Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 91.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In Telerik Reporting versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik Reporting install is present, a lower privileged user has the ability to manipulate the installation package to elevate their privileges on the underlying operating system.

Affected products (as reported)

Vendor	Product	Versions
Progress Software	Telerik Reporting	1.0 – before 2024 R1

Weakness: CWE-269 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://www.telerik.com/products/reporting.aspx product
https://docs.telerik.com/reporting/knowledge-base/legacy-installer-vulnerability vendor-advisory