CVE-2024-4358

The access protection mechanism in Telerik Report Server running on an IIS server can be bypassed by an unauthenticated attacker (CWE-290 – Authentication Bypass by Spoofing). A network attacker does not need any privileges or user interaction to exploit this vulnerability. As a result, it is possible to gain access to functionality reserved only for authenticated users.

An attacker can gain unauthorized access to protected functionality of Telerik Report Server, which may lead to violation of confidentiality, integrity, and availability of data and services managed by the reporting server.

Telerik Report Server should be updated as soon as possible to a version newer than 2024 Q1 (10.0.24.305), applying patches available from the vendor. Detailed instructions are available in the vendor's documentation at the address indicated in the references (knowledge-base/registration-auth-bypass-cve-2024-4358). Until the update is deployed, it is recommended to restrict network access to the Telerik Report Server instance only to trusted IP addresses.

Progress Telerik Report Server version 2024 Q1 (10.0.24.305) and earlier, running on an IIS server.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.