Vulnerabilities > CVE-2024-6096 - Unsafe Reflection vulnerability in Progress Telerik Reporting

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

progress

CWE-470

critical

NVD

Published: 2024-07-24

Updated: 2024-11-21

Summary

In Progress® Telerik® Reporting versions prior to 18.1.24.709, a code execution attack is possible through object injection via an insecure type resolution vulnerability.

Vulnerable Configurations

Part	Description	Count
Application	Progress Progress Telerik Reporting - Progress Telerik Reporting 8.2.14.1027 Progress Telerik Reporting 8.2.14.1204 Progress Telerik Reporting 9.0.15.225 Progress Telerik Reporting 9.0.15.324 Progress Telerik Reporting 9.1.15.624 Progress Telerik Reporting 9.1.15.731 Progress Telerik Reporting 9.2.15.930 Progress Telerik Reporting 9.2.15.1126 Progress Telerik Reporting 10.0.16.113 Progress Telerik Reporting 10.0.16.204 Progress Telerik Reporting 10.2.16.1025 Progress Telerik Reporting 11.0.17.118 Progress Telerik Reporting 11.0.17.222 Progress Telerik Reporting 11.0.17.406 Progress Telerik Reporting 11.1.17.503 Progress Telerik Reporting 11.1.17.614 Progress Telerik Reporting 11.2.17.913 Progress Telerik Reporting 11.2.17.1025 Progress Telerik Reporting 12.0.18.117 Progress Telerik Reporting 12.0.18.125 Progress Telerik Reporting 12.0.18.416 Progress Telerik Reporting 12.1.18.516 Progress Telerik Reporting 12.1.18.620 Progress Telerik Reporting 12.2.18.912 Progress Telerik Reporting 12.2.18.1017 Progress Telerik Reporting 12.2.18.1129 Progress Telerik Reporting 13.0.19.116 Progress Telerik Reporting 13.0.19.222 Progress Telerik Reporting 17.2.23.1114 Progress Telerik Reporting 18.0.24.130	31

Common Weakness Enumeration (CWE)

CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Vulnerabilities > CVE-2024-6096 - Unsafe Reflection vulnerability in Progress Telerik Reporting

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Related news

References