{"id":"CVE-2024-4358","aliases":["EUVD-2024-43994"],"status":"published","title":"Registration Authentication Bypass Vulnerability","description":"In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.97482,"percentile":0.999,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-290"],"published":"2024-05-29T14:51:21Z","modified":"2026-06-17T08:01:44Z","kev":{"date_added":"2024-06-13","due_date":"2024-07-04","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2024-06-13"},{"source":"kev","since":"2024-06-13"}],"exploits":[{"source":"pocgithub","id":"sinsinology/CVE-2024-4358","title":"sinsinology/CVE-2024-4358","date":"2024-06-03","url":"https://github.com/sinsinology/CVE-2024-4358"},{"source":"pocgithub","id":"Harydhk7/CVE-2024-4358","title":"Harydhk7/CVE-2024-4358","date":"2024-06-04","url":"https://github.com/Harydhk7/CVE-2024-4358"},{"source":"pocgithub","id":"RevoltSecurities/CVE-2024-4358","title":"RevoltSecurities/CVE-2024-4358","date":"2024-06-04","url":"https://github.com/RevoltSecurities/CVE-2024-4358"},{"source":"metasploit","id":"exploit/windows/http/telerik_report_server_deserialization","title":"Telerik Report Server Auth Bypass and Deserialization RCE","type":"exploit","platform":"Windows","date":"2024-06-04","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/windows/http/telerik_report_server_deserialization"},{"source":"pocgithub","id":"Sk1dr0wz/CVE-2024-4358_Mass_Exploit","title":"Sk1dr0wz/CVE-2024-4358_Mass_Exploit","date":"2024-06-05","url":"https://github.com/Sk1dr0wz/CVE-2024-4358_Mass_Exploit"},{"source":"pocgithub","id":"verylazytech/CVE-2024-4358","title":"verylazytech/CVE-2024-4358","date":"2024-06-09","url":"https://github.com/verylazytech/CVE-2024-4358"},{"source":"pocgithub","id":"gh-ost00/CVE-2024-4358","title":"gh-ost00/CVE-2024-4358","date":"2024-08-24","url":"https://github.com/gh-ost00/CVE-2024-4358"},{"source":"exploitdb","id":"EDB-52103","title":"Progress Telerik Report Server 2024 Q1 (10.0.24.305) - Authentication Bypass","type":"webapps","platform":"multiple","date":"2025-03-28","url":"https://www.exploit-db.com/exploits/52103"},{"source":"metasploit","id":"auxiliary/scanner/http/telerik_report_server_auth_bypass","title":"Telerik Report Server Auth Bypass","type":"auxiliary","date":"2024-06-04","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/telerik_report_server_auth_bypass"},{"source":"nuclei","id":"CVE-2024-4358","title":"Progress Telerik Report Server - Authentication Bypass","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4358.yaml"}],"products":[{"vendor":"progress","product":"telerik report server"},{"vendor":"progress software corporation","product":"telerik report server"},{"vendor":"progress_software","product":"telerik_report_server"},{"vendor":"telerik","product":"report_server_2024"}],"references":[{"url":"https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4358","tags":["x_transferred","Mitigation","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4358","tags":["government-resource","US Government Resource"]}],"sources":{"cve":[{"id":"CVE-2024-4358","title":"Registration Authentication Bypass Vulnerability","description":"In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.","status":"published","published":"2024-05-29T14:51:21.612Z","modified":"2025-10-21T23:05:17.218Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:34:17.150655Z"}],"euvd":[{"id":"EUVD-2024-43994","description":"In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.","status":"published","published":"2024-05-29T14:51:21Z","modified":"2025-10-21T23:05:17Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2024-06-13","updated_at":"2026-11-02T20:31:28.525814Z"}],"kev":[{"id":"CVE-2024-4358","title":"Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability","description":"Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.","cwes":["CWE-290"],"kev":{"date_added":"2024-06-13","due_date":"2024-07-04","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2024-4358","description":"In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.","status":"published","published":"2024-05-29T15:16:06.477Z","modified":"2026-06-17T08:01:44.54Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:10:02.520903Z"}]}}