Veille CVE
CVE-2024-4358
9.8 Critique Exploitée activementCatalogue CISA KEV — Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability
Ajoutée le 13/06/2024 · Échéance de correction (agences US) : 04/07/2024
Action requise : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 9.8 Critique | security@progress.com | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 9.8 Critique | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Faiblesses (CWE)
Références
- https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358 MitigationVendor Advisory
- https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358 MitigationVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4358 US Government Resource