CVE-2024-4358
Registration Authentication Bypass Vulnerability
CVE-2024-4358 is a critical vulnerability (CVSS 9.8) in Progress Telerik Report Server, published May 29, 2024. CISA lists it as known to be exploited, since June 13, 2024. EUVD reports exploitation since June 13, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 97.5%, the 99th percentile. No source names a fixed version.
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Registration Authentication Bypass Vulnerability
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
- Record
CVE-2024-4358- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-290
- Updated
- 2026-11-02
EUVDEUVD-2024-43994
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
- Record
EUVD-2024-43994- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
CISA KEV No score
Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability
Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.
- Record
CVE-2024-4358- Weakness
- CWE-290
- Updated
- 2026-11-02
NVD
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
- Record
CVE-2024-4358- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-290
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | sinsinology/CVE-2024-4358 | 2024-06-03 |
| PoC in GitHub | Harydhk7/CVE-2024-4358 | 2024-06-04 |
| PoC in GitHub | RevoltSecurities/CVE-2024-4358 | 2024-06-04 |
| Metasploit | Telerik Report Server Auth Bypass and Deserialization RCE | 2024-06-04 |
| PoC in GitHub | Sk1dr0wz/CVE-2024-4358_Mass_Exploit | 2024-06-05 |
| PoC in GitHub | verylazytech/CVE-2024-4358 | 2024-06-09 |
| PoC in GitHub | gh-ost00/CVE-2024-4358 | 2024-08-24 |
| Exploit-DB | Progress Telerik Report Server 2024 Q1 (10.0.24.305) - Authentication Bypass | 2025-03-28 |
| Metasploit | Telerik Report Server Auth Bypass | 2024-06-04 |
| Nuclei | Progress Telerik Report Server - Authentication Bypass |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | exploitation, exploits | |
| 2026-11-02 | created | CVE List, EUVD, Exploit-DB, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub |