Vulnerabilities > CVE-2024-4357 - XXE vulnerability in Progress Telerik Reporting

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

progress

CWE-611

NVD

Published: 2024-05-15

Updated: 2025-01-16

Summary

An information disclosure vulnerability exists in Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, allows low-privilege attacker to read systems file via XML External Entity Processing.

Vulnerable Configurations

Part	Description	Count
Application	Progress Progress Telerik Reporting - Progress Telerik Reporting 8.2.14.1027 Progress Telerik Reporting 8.2.14.1204 Progress Telerik Reporting 9.0.15.225 Progress Telerik Reporting 9.0.15.324 Progress Telerik Reporting 9.1.15.624 Progress Telerik Reporting 9.1.15.731 Progress Telerik Reporting 9.2.15.930 Progress Telerik Reporting 9.2.15.1105 Progress Telerik Reporting 9.2.15.1126 Progress Telerik Reporting 10.0.16.113 Progress Telerik Reporting 10.0.16.204 Progress Telerik Reporting 10.1.16.504 Progress Telerik Reporting 10.1.16.615	14

Common Weakness Enumeration (CWE)

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References