PT-2024-3248 · Progress · Progress Telerik Reporting
07842C0E165D4D2D8733Dd4Eab48B3Ed0F7Afe38
·
Published
2024-03-20
·
Updated
2025-01-16
·
CVE-2024-1801
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Progress Telerik Reporting versions prior to 2024 Q1 (18.0.24.130)
Description
The issue is related to an insecure deserialization vulnerability in the ObjectReader class of Progress Telerik Reporting, which can be exploited by a local threat actor to execute arbitrary code. This can be achieved through a specially crafted file, allowing the attacker to perform a code execution attack.
Recommendations
For versions prior to 2024 Q1 (18.0.24.130), update to version 2024 Q1 (18.0.24.130) or later to resolve the issue.
As a temporary workaround, consider restricting the use of the ObjectReader class until a patch is available.
Avoid using the deserialization mechanism with untrusted data in the affected Progress Telerik Reporting versions until the issue is resolved.
At the moment, there is no additional information about other mitigation measures.
Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Progress Telerik Reporting