PT-2024-38619 · Progress · Telerik Reporting

Published 2024-10-09 · Updated 2024-10-15 · CVE-2024-7840

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924)

Description A command injection attack is possible through improper neutralization of hyperlink elements. This issue arises due to the improper handling of hyperlink elements, allowing for potential command injection attacks.

Recommendations For In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), update to version 2024 Q3 (18.2.24.924) or later to resolve the issue. As a temporary workaround, consider restricting the use of hyperlink elements in reports until a patch is applied.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-7840

Affected Products

Telerik Reporting

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-7840 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7840 · Vendor Advisory
• https://docs.telerik.com/reporting/knowledge-base/command-injection-cve-2024-7840 · Vendor Advisory
• https://t.me/cvedetector/7485 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1844092559649333699 · Twitter Post
• https://security.netapp.com/advisory/ntap-20250425-0004 · Note
• https://twitter.com/CVEnew/status/1844058718209786211 · Twitter Post
• https://t.me/cvenotify/98091 · Telegram Post