Vulnerabilities > CVE-2024-8015 - Unsafe Reflection vulnerability in Progress Telerik Report Server

CVSS 7.2 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

HIGH

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

progress

CWE-470

NVD

Published: 2024-10-09

Updated: 2024-10-15

Summary

In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability.

Vulnerable Configurations

Part	Description	Count
Application	Progress Progress Telerik Report Server - Progress Telerik Report Server 1.0.0 Progress Telerik Report Server 1.1.15.624 Progress Telerik Report Server 1.2.15.930 Progress Telerik Report Server 1.2.15.1106 Progress Telerik Report Server 2.0.16.113 Progress Telerik Report Server 2.0.16.204 Progress Telerik Report Server 2.1.16.504 Progress Telerik Report Server 2.1.16.615 Progress Telerik Report Server 2.2.16.914 Progress Telerik Report Server 3.0.17.301 Progress Telerik Report Server 3.0.17.406 Progress Telerik Report Server 3.1.17.503 Progress Telerik Report Server 3.1.17.614 Progress Telerik Report Server 3.2.17.913 Progress Telerik Report Server 3.2.17.1025 Progress Telerik Report Server 4.0.18.117 Progress Telerik Report Server 4.0.18.125 Progress Telerik Report Server 4.0.18.227 Progress Telerik Report Server 4.0.18.417 Progress Telerik Report Server 4.1.18.516 Progress Telerik Report Server 4.1.18.620 Progress Telerik Report Server 4.2.18.912 Progress Telerik Report Server 4.2.18.1017 Progress Telerik Report Server 4.2.18.1129 Progress Telerik Report Server 5.0.19.116 Progress Telerik Report Server 5.0.19.222 Progress Telerik Report Server 5.1.19.514 Progress Telerik Report Server 5.1.19.618 Progress Telerik Report Server 5.2.19.918 Progress Telerik Report Server 5.2.19.1030 Progress Telerik Report Server 6.0.20.115 Progress Telerik Report Server 6.0.20.219 Progress Telerik Report Server 6.1.20.513 Progress Telerik Report Server 6.1.20.618 Progress Telerik Report Server 6.2.20.916 Progress Telerik Report Server 6.2.20.1021 Progress Telerik Report Server 7.0.21.120 Progress Telerik Report Server 7.0.21.224 Progress Telerik Report Server 7.0.21.326 Progress Telerik Report Server 7.1.21.512 Progress Telerik Report Server 7.1.21.616 Progress Telerik Report Server 7.2.21.915 Progress Telerik Report Server 7.2.21.1110 Progress Telerik Report Server 7.2.21.1125 Progress Telerik Report Server 8.0.22.119 Progress Telerik Report Server 8.0.22.225 Progress Telerik Report Server 8.1.22.511 Progress Telerik Report Server 8.1.22.622 Progress Telerik Report Server 8.2.22.914 Progress Telerik Report Server 8.2.22.1109 Progress Telerik Report Server 9.0.23.118 Progress Telerik Report Server 9.0.23.315 Progress Telerik Report Server 9.1.23.606 Progress Telerik Report Server 9.1.23.718 Progress Telerik Report Server 9.2.23.1010 Progress Telerik Report Server 9.2.23.1114 Progress Telerik Report Server 9.2.24.305 Progress Telerik Report Server 10.0.24.130 Progress Telerik Report Server 10.0.24.305 Progress Telerik Report Server 10.1.24.514 Progress Telerik Report Server 10.1.24.709 Progress Telerik Report Server 10.2.16.1025	63

Common Weakness Enumeration (CWE)

CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

References

https://docs.telerik.com/report-server/knowledge-base/insecure-type-resolution-cve-2024-8015