Detections
Analytics

Progress Telerik Report Server <= 10.2.24.924 Encryption Weakness (CVE-2024-7295)

medium Nessus Plugin ID 211469

Language:

Synopsis

The version of Progress Telerik Report Server installed on the remote host is affected by an encryption weakness vulnerability.

Description

The version of Progress Telerik Report Server installed on the remote host is affected by an encryption weakness vulnerability:

 - The encryption of local asset data used an older algorithm which may allow a sophisticated actor to decrypt this information. (CVE-2024-7295)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Progress Telerik Report Server 2024 Q4 (10.3.24.1112) or later.

See Also

http://www.nessus.org/u?0dad329a

Plugin Details

Severity: Medium

ID: 211469

File Name: progress_telerik_report_server_10_3_24_1112.nasl

Version: 1.3

Type: remote

Family: CGI abuses

Published: 11/15/2024

Updated: 11/19/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2024-7295

CVSS v3

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 5.4

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: x-cpe:/a:progress:telerik_report_server

Required KB Items: installed_sw/Progress Telerik Report Server

Exploit Ease: No known exploits are available

Patch Publication Date: 11/13/2024

Vulnerability Publication Date: 11/13/2024

Reference Information

CVE: CVE-2024-7295

IAVB: 2024-B-0173