Detections
Analytics
Progress Telerik Report Server Authentication Bypass
critical Web App Scanning Plugin ID 114294
Language:
Synopsis
Progress Telerik Report Server Authentication BypassDescription
Progress Telerik Report Server version prior to 2024 Q1 (10.0.24.305) is vulnerable to authentication bypass and an insecure deserialization, allowing an unauthenticated attacker to execute code remotely via a specially forged request.Solution
Upgrade to Progress Telerik Report Server versions 2024 Q1 (10.0.24.305) or later.See Also
https://docs.telerik.com/report-server/knowledge-base/deserialization-vulnerability-cve-2024-1800
https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358
Plugin Details
Severity: Critical
ID: 114294
Type: remote
Family: Component Vulnerability
Published: 6/5/2024
Updated: 6/5/2024
Scan Template: basic, full, pci, scan
Risk Information
VPR
Risk Factor: Critical
Score: 9.9
CVSS v2
Risk Factor: Critical
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2024-4358
CVSS v3
Risk Factor: Critical
Base Score: 9.9
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score Source: CVE-2024-1800
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 3/7/2024
Vulnerability Publication Date: 3/7/2024
CISA Known Exploited Vulnerability Due Dates: 7/4/2024
Reference Information
CVE: CVE-2024-1800, CVE-2024-4358
OWASP: 2010-A3, 2010-A4, 2013-A2, 2013-A4, 2013-A9, 2017-A2, 2017-A8, 2017-A9, 2021-A6, 2021-A7, 2021-A8
WASC: Improper Input Handling, Insufficient Authentication
CAPEC: 21, 22, 459, 461, 473, 476, 586, 59, 60, 94
DISA STIG: APSC-DV-001870, APSC-DV-002560, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(a)(2)(i)
ISO: 27001-A.13.1.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5, 27001-A.18.1.3, 27001-A.6.2.2, 27001-A.9.1.2, 27001-A.9.4.1, 27001-A.9.4.4, 27001-A.9.4.5
NIST: sp800_53-AC-3, sp800_53-CM-6b, sp800_53-SI-10(5)
OWASP API: 2019-API7, 2019-API8, 2023-API8
OWASP ASVS: 4.0.2-14.2.1, 4.0.2-4.1.3, 4.0.2-5.5.1
PCI-DSS: 3.2-6.2, 3.2-6.5.1, 3.2-6.5.10