CVE-2024-4358

Registration Authentication Bypass Vulnerability

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

Affected

Progress Software Corporation · Telerik Report Server

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

97.48% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2024-06-13

Nuclei

critical

Published

2024-05-29

Updated

2025-10-21

Proof-of-concept exploits (7)

• Harydhk7/CVE-2024-43580★ · 2024-06-04
• RevoltSecurities/CVE-2024-43585★ · 2024-06-04
• Sk1dr0wz/CVE-2024-4358_Mass_Exploit24★ · 2024-06-05
• fa-rrel/CVE-2024-43583★ · 2024-08-24
• gh-ost00/CVE-2024-43583★ · 2024-08-24
• sinsinology/CVE-2024-435878★ · 2024-06-06
• verylazytech/CVE-2024-435813★ · 2024-11-26

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4358.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/telerik_report_serv…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52103

Security advisories

• https://docs.telerik.com/report-server/knowledge-base/registration-auth-bypass-cve-2024-4…

References

• CVE Record
• NVD entry

Related

• CVE-2024-1800
• CVE-2023-20198
• CVE-2023-22518
• CVE-2023-22527
• CVE-2023-46747
• CVE-2023-4966