ZDI-CAN-23001: ZDI-24-401: Progress Software Telerik Reporting ObjectReader Deserialization of Untrusted Data Remote Code Execution Vulnerability

Published Apr 25, 2024

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Telerik Reporting. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-1801.

Affected Software

1 affected component

Progress Software Telerik Reporting

Event History

Apr 25, 2024

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-23001?

ZDI-CAN-23001 has been classified as a critical vulnerability due to its potential for remote code execution.

How do I fix ZDI-CAN-23001?

To fix ZDI-CAN-23001, update your installation of Progress Software Telerik Reporting to the latest version provided by the vendor.

What is the impact of ZDI-CAN-23001?

The impact of ZDI-CAN-23001 is that it allows remote attackers to execute arbitrary code, potentially compromising the affected systems.

Is user interaction required for ZDI-CAN-23001?

Yes, user interaction is required for ZDI-CAN-23001 as the target must visit a malicious page or open a malicious file.

Which software is affected by ZDI-CAN-23001?

ZDI-CAN-23001 affects installations of Progress Software Telerik Reporting.