CVE-2024-4358

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 97,5%

Kerentanan Authentication Bypass by Spoofing pada telerik report server 2024. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 13 Juni 2024, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

Rincian

Terbit di NVD

29 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-290: Authentication Bypass by Spoofing

EPSS (30 hari)

97,5% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability

Masuk KEV

13 Juni 2024

Tenggat CISA

4 Juli 2024 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358 mitigasi · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4358 pemerintah AS