PT-2024-30601 · Progress · Telerik Report Server

Sina Kheirkhah · Published 2024-05-15 · Updated 2025-01-16 · CVE-2024-4357

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Progress Telerik Report Server versions 10.0.24.305 or earlier

Description An information disclosure issue exists, allowing a low-privilege attacker to read system files via XML External Entity Processing. This is related to the ValidateMetadaUri function and XML External Entity Processing.

Recommendations For versions 10.0.24.305 or earlier, consider disabling the ValidateMetadaUri function as a temporary workaround until a patch is available. Restrict access to sensitive system files to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2024-4357

ZDI-24-518

Affected Products

Telerik Report Server

References · 5

• https://zerodayinitiative.com/advisories/ZDI-24-518 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-4357 · Security Note
• https://docs.telerik.com/report-server/knowledge-base/xxe-vulnerability-cve-2024-4357 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-4357 · Vendor Advisory
• https://t.me/cvenotify/79902 · Telegram Post