PT-2024-7989 · Progress · Telerik Reporting

Markus Wulftange · Published 2024-08-21 · Updated 2024-10-15 · CVE-2024-8048

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924)

Description The issue is related to insecure expression evaluation, allowing for object injection and potentially leading to code execution attacks. This can be exploited by providing input that enables external control over class selection, which may permit an attacker to execute arbitrary code.

Recommendations For versions prior to 2024 Q3 (18.2.24.924), update to version 2024 Q3 (18.2.24.924) or later to resolve the issue. As a temporary workaround, consider restricting the use of insecure expression evaluation until a patch is applied. Avoid using vulnerable functions or parameters that may facilitate object injection attacks.

Fix

Weakness Enumeration

CWE-470

Related Identifiers

BDU:2024-09503

CVE-2024-8048

Affected Products

Telerik Reporting

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-8048 · Security Note
• https://docs.telerik.com/reporting/knowledge-base/insecure-expression-evaluation-cve-2024-8048 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09503 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8048 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1844069257312616926 · Twitter Post
• https://t.me/cvedetector/7481 · Telegram Post
• https://twitter.com/codewhitesec/status/1844444468738654688 · Twitter Post
• https://vuldb.com/?id.279885 · Note
• https://t.me/cvenotify/98094 · Telegram Post
• https://twitter.com/CVEnew/status/1844058727038714333 · Twitter Post
• https://security.netapp.com/advisory/ntap-20250425-0004 · Note