9.8

CVE-2024-4358: Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability

CVSS: 9.8v3.1CriticalKEVAnalyzed
Published 29-05-2024Last modified 21-10-2025
Open JSON

Vulnerability summary

CVE-2024-4358 is a critical (CVSS 9.8) Authentication Bypass by Spoofing vulnerability in Progress Telerik Report Server. It is known to be exploited: CISA lists it, first on 13-06-2024. EPSS estimates a 97.48% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
97.48%
0%100%
Critical · 0.00 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits3exploit-database, metasploit

Timeline

  1. 29-05-2024
    PublishedVulnerability first disclosed.
  2. 13-06-2024
    Added to CISA KEVProgress Telerik Report Server Authentication Bypass by Spoofing Vulnerability
  3. 04-07-2024
    CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

97.48%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 97.48% on 20-09-2026

20-09-202620-10-2026
EPSS score
97.48%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
13-06-2024
Federal due date
04-07-2024

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358 nvd.nist.gov/vuln/detail/CVE-2024-4358

Public exploits

3 found
  • exploit-databasemultipleUnverified

    Progress Telerik Report Server 2024 Q1 (10.0.24.305) - Authentication Bypass

    Maturity: poc

  • MetasploitMetasploitremoteUnverified

    Telerik Report Server Auth Bypass

    auxiliary/scanner/http/telerik_report_server_auth_bypass

    Maturity: poc

  • MetasploitMetasploitremoteVerified

    Telerik Report Server Auth Bypass and Deserialization RCE

    exploit/windows/http/telerik_report_server_deserialization

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Progress software corporation1 product
Telerik1 product

2 vendors · 2 products

References

2 links