CVE-2024-4357: XML External Entity Processing Information Disclosure
An information disclosure vulnerability exists in Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, allows low-privilege attacker to read systems file via XML External Entity Processing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Telerik Report Serverto a version that resolves this vulnerability.Fixed in 2024 Q1 (10.0.24.305) - Compensating control
Mitigate XML External Entity Processing (XXE) in Progress Telerik Report Server to prevent information disclosure via XML External Entity Processing.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4357?
CVE-2024-4357 is classified as an information disclosure vulnerability.
How do I fix CVE-2024-4357?
To fix CVE-2024-4357, upgrade to Progress Telerik Report Server version 2024 Q1 (10.1.24.514) or later.
Who is affected by CVE-2024-4357?
CVE-2024-4357 affects users of Progress Telerik Report Server version 2024 Q1 (10.0.24.305) or earlier.
What type of attack does CVE-2024-4357 enable?
CVE-2024-4357 enables low-privilege attackers to read sensitive system files.
What is XML External Entity Processing related to CVE-2024-4357?
XML External Entity Processing is a technique exploited in CVE-2024-4357 that allows unauthorized access to system files.