CVE-2024-8015
Telerik Report Server Insecure Type Resolution
CVE-2024-8015 is a critical vulnerability (CVSS 9.1) in Progress Telerik Report Server, published October 9, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.82%, the 57th percentile. No source names a fixed version.
In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Telerik Report Server Insecure Type Resolution
In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability.
- Record
CVE-2024-8015- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-470
- Updated
- 2026-11-02
EUVDEUVD-2024-48887
In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability.
- Record
EUVD-2024-48887- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c473-vf2f-6x9m
In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code...
In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability.
- Record
GHSA-c473-vf2f-6x9m- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-470
- Updated
- 2026-11-02
NVD
In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability.
- Record
CVE-2024-8015- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-470
- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases, products, published | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |