CVE-2024-4358

Progress Software Corporation Telerik Report Server, progress_software telerik_report_server

Published 29 May 2024 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 13 Jun 2024, with a remediation deadline of 4 Jul 2024 for US federal agencies.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

References

docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358 · Mitigation, Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4358 · US Government Resource