ZDI-CAN-23903: ZDI-24-403: Progress Software Telerik Report Server ObjectReader Deserialization of Untrusted Data Remote Code Execution Vulnerability
Published Apr 25, 2024
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Telerik Report Server. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2024-1800.
Affected Software
1 affected component
Progress Software Telerik Report Server
Event History
Apr 25, 2024
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-CAN-23903?
The severity of ZDI-CAN-23903 is rated at 8.8, indicating a high risk to affected installations.
2
What software is affected by ZDI-CAN-23903?
ZDI-CAN-23903 affects Progress Software Telerik Report Server installations.
3
Is authentication required to exploit ZDI-CAN-23903?
Yes, authentication is required to exploit the ZDI-CAN-23903 vulnerability.
4
How do I fix ZDI-CAN-23903?
To fix ZDI-CAN-23903, you should update your Progress Software Telerik Report Server to the latest security patch.
5
What type of attack is possible with ZDI-CAN-23903?
ZDI-CAN-23903 allows remote attackers to execute arbitrary code on affected installations.