ZDI-CAN-23902: ZDI-24-402: Progress Software Telerik Reporting ObjectReader Deserialization of Untrusted Data Remote Code Execution Vulnerability
Published Apr 25, 2024
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Telerik Reporting. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2024-1856.
Affected Software
1 affected component
Progress Software Telerik Reporting
Event History
Apr 25, 2024
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-CAN-23902?
The ZDI-CAN-23902 vulnerability has a CVSS rating of 7.2, indicating high severity.
2
How do I fix ZDI-CAN-23902?
To remediate ZDI-CAN-23902, ensure that you apply the latest updates and patches provided by Progress Software for Telerik Reporting.
3
What systems are affected by ZDI-CAN-23902?
ZDI-CAN-23902 affects installations of Progress Software Telerik Reporting.
4
Can ZDI-CAN-23902 be exploited without authentication?
No, ZDI-CAN-23902 requires authentication to be exploited by remote attackers.
5
What is the nature of the attack for ZDI-CAN-23902?
ZDI-CAN-23902 allows remote attackers to execute arbitrary code on affected systems.