ZDI-24-402: Progress Software Telerik Reporting ObjectReader Deserialization of Untrusted Data Remote Code Execution Vulnerability
Published Apr 25, 2024
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Telerik Reporting. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2024-1856.
Affected Software
1 affected component
Progress Software Telerik Reporting
Event History
Apr 25, 2024
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-24-402?
ZDI-24-402 has a CVSS rating of 7.2, indicating a high severity vulnerability.
2
What type of attack can be executed due to ZDI-24-402?
ZDI-24-402 allows remote attackers to execute arbitrary code on affected installations.
3
Is authentication required to exploit ZDI-24-402?
Yes, authentication is required to successfully exploit the vulnerability ZDI-24-402.
4
Which software is affected by ZDI-24-402?
ZDI-24-402 affects Progress Software Telerik Reporting installations.
5
What is the CVE associated with ZDI-24-402?
The CVE associated with ZDI-24-402 is CVE-2024-1856.