PT-2024-38243 · Progress · Telerik Report Server

Published 2024-10-09 · Updated 2024-10-15 · CVE-2024-7294

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.806)

Description The issue allows for an HTTP DoS attack on anonymous endpoints without rate limiting. This can potentially lead to service disruption.

Recommendations For versions prior to 2024 Q3 (10.2.24.806), update to version 2024 Q3 (10.2.24.806) or later to resolve the issue. As a temporary workaround, consider implementing rate limiting on anonymous endpoints to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-7294

Affected Products

Telerik Report Server

References · 7

• https://osv.dev/vulnerability/CVE-2024-7294 · Vendor Advisory
• https://docs.telerik.com/report-server/knowledge-base/uncontrolled-resource-consumption-cve-2024-7294 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7294 · Security Note
• https://t.me/cvedetector/7484 · Telegram Post
• https://twitter.com/CVEnew/status/1844058716028666012 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1844063879996801339 · Twitter Post
• https://t.me/cvenotify/98090 · Telegram Post