CVE-2024-4358: Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
Other sources
Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4358?
CVE-2024-4358 is considered a critical vulnerability due to its potential for unauthorized access and exploitation.
How do I fix CVE-2024-4358?
To fix CVE-2024-4358, update Progress Telerik Report Server to version 2024 Q1 (10.0.24.306) or later.
What type of vulnerability is CVE-2024-4358?
CVE-2024-4358 is an authentication bypass vulnerability that allows unauthenticated access to restricted functionality.
Who is affected by CVE-2024-4358?
CVE-2024-4358 affects users running Progress Telerik Report Server version 2024 Q1 (10.0.24.305) or earlier on IIS.
Can CVE-2024-4358 lead to data exposure?
Yes, CVE-2024-4358 can lead to data exposure as it allows unauthorized users to access restricted features.