CVE-2024-4358

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-290

Affected software

No affected versions have been published.

Timeline

Published
May 29, 2024
Last modified
Jun 17, 2026
Added to CISA KEV
Jun 13, 2024
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-435805.4Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2024-435817.1Microsoft OpenSSH for Windows Remote Code Execution VulnerabilityCVE-2024-435828.1Remote Desktop Protocol Server Remote Code Execution VulnerabilityCVE-2024-435837.8Winlogon Elevation of Privilege VulnerabilityCVE-2024-435848.4Windows Scripting Engine Security Feature Bypass VulnerabilityCVE-2024-435855.5Code Integrity Guard Security Feature Bypass VulnerabilityCVE-2024-435878.1Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2024-435898.8Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-43596.5The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerabCVE-2024-435907.8Visual C++ Redistributable Installer Elevation of Privilege VulnerabilityCVE-2024-435919.1Azure Command Line Integration (CLI) Elevation of Privilege VulnerabilityCVE-2024-435928.8Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-4358: Critical severity, CVSS 9.8 | Vulnix