Risk | High |
Patch available | YES |
Number of vulnerabilities | 2 |
CVE-ID | CVE-2024-4357 CVE-2024-4358 |
CWE-ID | CWE-611 CWE-290 |
Exploitation vector | Network |
Public exploit | Vulnerability #2 is being exploited in the wild. |
Vulnerable software Subscribe |
Report Server Server applications / Other server solutions |
Vendor | Progress Telerik |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
Updated 10.06.2024
Added vulnerability #2
EUVDB-ID: #VU90127
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-4357
CWE-ID:
CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient validation of user-supplied XML input within the implementation of ValidateMetadaUri method. A remote user can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.
Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.
MitigationInstall updates from vendor's website.
Vulnerable software versionsReport Server: 10.0.24.305
External linkshttp://docs.telerik.com/report-server/knowledge-base/xxe-vulnerability-cve-2024-4357
http://www.zerodayinitiative.com/advisories/ZDI-24-518/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU91592
Risk: High
CVSSv3.1: 9.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]
CVE-ID: CVE-2024-4358
CWE-ID:
CWE-290 - Authentication Bypass by Spoofing
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to the lack of validating the current installation step within the implementation of the Register method. A remote attacker can bypass authentication on the system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsReport Server: 10.0.24.305
External linkshttp://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358
http://www.zerodayinitiative.com/advisories/ZDI-24-561/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.