# CVE-2024-4358

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

- Page: https://www.vulneraibility.com/cve/CVE-2024-4358
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2024-06-13; CISA due date 2024-07-04
- EPSS: 97.48% (percentile 99.9)
- Public exploit code: 1 on Exploit-DB · 2 Metasploit modules · 6 GitHub proofs of concept · 1 Nuclei template (first 2024-06-03)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2024-06-14)
- Weakness: CWE-290
- Published: 2024-05-29

## Affected versions

- Progress Software Corporation Telerik Report Server: affected >= 1.0.0 and < 10.1.24.514

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4358

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.