QID 731289

Date Published: 2024-03-26

QID 731289: Progress Telerik Report Server Insecure Deserialization Vulnerability

Progress Telerik Report Server is a server-based reporting platform that provides comprehensive reports management. It provides a centralized storage for the reports and various ways to organize and preview them.

Progress Telerik Report Server is vulnerable to a remote code execution attack through an insecure deserialization vulnerability.

Affected Versions:
Report Server 10.0.24.130 and prior versions.

Patched Version:
Report Server 10.0.24.305 and later versions.

QID Detection Logic (Unauthenticated):
This QID checks for vulnerable version of Progress Telerik Report Server by sending an HTTP GET request to the 'Account/Login' endpoint and extracting the version from the response received.

Successful exploitation of the vulnerability may allow a remote unauthenticated attacker to execute arbitrary code, leading to complete system compromise.

CVSS V3 rated as Critical - 9.9 severity.

CVSS V2 rated as Critical - 10 severity.

Solution

Customers are advised to upgrade to version 10.0.24.305 or later to address the vulnerability. For more information, please refer to the Progress Security Advisory

Vendor References

Progress Security Advisory - docs.telerik.com/report-server/knowledge-base/deserialization-vulnerability-cve-2024-1800

CVEs related to QID 731289

CVE-2024-1800 |

Software Advisories

Advisory ID	Software	Component	Link
Progress Security Advisory			docs.telerik.com/report-server/knowledge-base/deserialization-vulnerability-cve-2024-1800

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].