Read the docs
TI-2024-04501 Aliases CVE-2024-4837GHSA-856w-rm82-4hp7

Trust Boundary Violation Vulnerability

Priority LOW 30CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via a trust boundary violation vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00431 37th percentileScored 2026-11-07
Fix Fixed Telerik Report Server (Progress Software): 10.1.24.514

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ProgressTelerik Report Server1.0.0.0 to before 10.1.24.51410.1.24.514Patch availableCNA
  • Telerik Report Server VendorProgress Affected 1.0.0.0 to before 10.1.24.514 Fixed in 10.1.24.514 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:progress:telerik_report_server:*:*:*:*:*:*:*:*before 10.1.24.514VulnerableProgress
  • cpe:2.3:a:progress:telerik_report_server:*:*:*:*:*:*:*:* Versions before 10.1.24.514 Vulnerable ·Progress

Remediation

  • Fix · CNA Telerik Report Server (Progress Software) Fixed in 10.1.24.514

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-4837
  2. 2026-10-03 Alias added: GHSA-856w-rm82-4hp7

References

Advisory 1

  • TI-2024-01676 Progress Telerik Report Server Deserialization CVSS 3.1CRITICAL 9.9
  • TI-2024-05871 Progress Telerik Report Server Deserialization CVSS 3.1CRITICAL 9.9
  • TI-2024-07429 Telerik Report Server Insecure Type Resolution CVSS 3.1CRITICAL 9.1
  • TI-2025-00460 Telerik Report Server Clear Text Transmission of Agent Commands CVSS 3.1HIGH 8.8
  • TI-2024-06754 Account Controller allows high count of login attempts CVSS 3.1HIGH 8.8
  • TI-2024-06757 Hard-coded credentials used for temporary and cache data encryption CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences