CVE-2024-4358

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-290

Affected software

Vendor	Product	Versions
Progress Software Corporation	Telerik Report Server	>= 1.0.0, < 10.1.24.514
progress_software	telerik_report_server	>= 1.0.0.0, < 10.1.24.514

References

https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358Mitigation, Vendor Advisory
https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358Mitigation, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4358US Government Resource

Timeline

Published: May 29, 2024
Last modified: Jun 17, 2026
Added to CISA KEV: Jun 13, 2024
NVD status: Analyzed

Related CVEs from 2024