CVE-2024-4358

Vulnerability ID

CVE-2024-4358

Severity

CRITICAL

Severity Score

9.8

Summary

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

References

https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358

Mitigation and Patches

https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358

Exploits

https://github.com/sinsinology/CVE-2024-4358

https://github.com/Sk1dr0wz/CVE-2024-4358_Mass_Exploit

https://github.com/RevoltSecurities/CVE-2024-4358

https://github.com/sinsinology/CVE-2024-4358

https://github.com/RevoltSecurities/CVE-2024-4358

https://github.com/Sk1dr0wz/CVE-2024-4358_Mass_Exploit

https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/telerik_report_server_auth_bypass.rb

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/telerik_report_server_deserialization.rb

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Metasploit Payload

-

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE ID

CWE-290

CVE-2024-4358

Recent Publish

See SecOps Solution
in action

Products

Compare

Company

Resources

Try It

CVE-2024-4358

Recent Publish

See SecOps Solutionin action

Products

Compare

Company

Resources

Try It

See SecOps Solution
in action