CVE-2024-4358
CriticalActively exploited (CISA KEV)
Description
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Progress Telerik Report Server
PublishedMay 29, 2024
First seenMay 29, 2024
Added to KEVJun 13, 2024
Weakness typeCWE-290CWE-290
How to fix
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date: Jul 4, 2024Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| telerik report_server_2024 | v ≤ 10.0.24.305 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.