PT-2024-38241 · Progress · Progress Telerik Report Server

Published 2024-10-09 · Updated 2024-10-15 · CVE-2024-7292

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.806)

Description A credential stuffing attack is possible through improper restriction of excessive login attempts. This issue allows attackers to attempt multiple logins without being properly restricted, potentially leading to unauthorized access.

Recommendations For In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.806), update to version 2024 Q3 (10.2.24.806) or later to resolve the issue. As a temporary workaround, consider implementing additional security measures to restrict excessive login attempts, such as rate limiting or IP blocking, until a patch is applied.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2024-7292

Affected Products

Progress Telerik Report Server

References · 8

• https://docs.telerik.com/report-server/knowledge-base/improper-restriction-of-excessive-login-attempts-cve-2024-7292 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7292 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7292 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1844060294823268620 · Twitter Post
• https://t.me/cvedetector/7495 · Telegram Post
• https://twitter.com/CVEnew/status/1844058714980102177 · Twitter Post
• https://twitter.com/Brandefense/status/1845864126012158378 · Twitter Post
• https://t.me/cvenotify/98088 · Telegram Post