CVE-2024-4358
Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability
Published May 29, 2024 · updated Jun 17, 2026 · telerik report server 2024
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
Timeline
Detection, updates, and resolution for this record.
May 29, 2024 · Catalog
Detected
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
Jun 13, 2024 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jul 4, 2024 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jun 17, 2026 · Catalog
Updated
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date Jul 4, 2024
Affected
- cpe telerik/report server 2024version unspecified
- vendor Progress Telerik Report Serverversion unspecified
Sources
- CISA KEVCVE-2024-4358
Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.
cisa.gov - CVE.orgCVE-2024-4358
Official CVE identifier
cve.org - FIRST EPSSCVE-2024-4358
30-day exploitation probability 97.5%
first.org - Exploit Database52103
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesauxiliary_scanner/http/telerik_report_server_auth_bypass
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com - Metasploit Modulesexploit_windows/http/telerik_report_server_deserialization
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2024-4358
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
nvd.nist.gov