CVE-2024-4358 kev in the critical feed json
Registration Authentication Bypass Vulnerability
published 2024-05-29 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-43994
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Exploited
- added 2024-06-13
- epss
- 97.5%
- EPSS 97.5% chance of exploitation in 30 days, percentile 99.8%
- public exploits
- 3
- Metasploit, Exploit-DB, plus a Nuclei check
Summary
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
Patch / fix
cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Progress Software Corporation Telerik Report Server 10.1.24.514
- progress_software telerik_report_server 10.1.24.514
Timeline
- Published
- First public exploit (Metasploit auxiliary/scanner/http/telerik_report_server_auth_bypass)
- Added to CISA KEV
- CISA SSVC: exploitation active
- CISA patch deadline
Known exploited
- Added
- 2 y ago
- Patch by
- 2024-07-04 (2 y ago)
- Ransomware
- Not known
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Vendor, product
- Progress, Telerik Report Server
- CISA name
- Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability
ATT&CK techniques
How it is exploited and what it leads to, in MITRE ATT&CK terms.
- T1190 Exploit Public-Facing Application exploitation
kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
97.48% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit auxiliary/scanner/http/telerik_report_server_auth_bypass Telerik Report Server Auth Bypass metasploit auxiliary, normal rank, 2024-06-04
- Metasploit exploit/windows/http/telerik_report_server_deserialization Telerik Report Server Auth Bypass and Deserialization RCE metasploit exploit, excellent rank, 2024-06-04
- EDB-52103 Progress Telerik Report Server 2024 Q1 (10.0.24.305) - Authentication Bypass webapps, 2025-03-28
- Nuclei template Progress Telerik Report Server - Authentication Bypass nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Progress Software Corporation Telerik Report Server
- progress_software telerik_report_server
Classification
- Weakness
-
- CWE-290 Authentication Bypass by Spoofing
References
-
docs.telerik.com
/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358
mitigation, vendor-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4358
government-resource, us-government-resource
Sources
- CVE List CVE-2024-4358
- NVD CVE-2024-4358
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.