Vulnerability Intelligence Report
Registration Authentication Bypass Vulnerability
CVE-2024-4358
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
CISA KEV
Nuclei Template
SSVC: Active Exploitation
Automatable
CVSS Base Score
9.8
CRITICAL
Exploitability:3.9
Impact Score:5.9
EPSS Probability:97.48%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-290 ↗CWE-290 Authentication Bypass by Spoofing
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Progress Software Corporation | Telerik Report Server | 1.0.0 < 10.1.24.514 (affected) |
Threat Intelligence Signals
CISA KEV
ACTIVE IN CATALOG
Nuclei Template
SCANNER AVAILABLE
EPSS Score
97.482%
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Progress Software Corporation · Vendor · USA |
| Reserved | 2024-04-30T17:34:38 |
| Published | 2024-05-29T14:51:21 |
| Patch Date | 2024-05-29 |
| Last Updated | 2025-10-21T23:05:17 |
Community Chatter & Buzz