VULNERABILITY INTELLIGENCE

CVE-2024-4358

CVSS score9.8 CRITICAL

EPSS probability97.48%

CISA KEVKnown exploited vulnerability

Published2024-05-29

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability

Vendor / product: Progress / Telerik Report Server

Description

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

Weakness classification

security@progress.com: CWE-290
nvd@nist.gov: CWE-290

Primary references

security@progress.com — Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource