Vulnerabilites related to Progress Software - Telerik Reporting
cve-2024-8048
Vulnerability from cvelistv5
Published
2024-10-09 14:18
Modified
2024-10-09 16:02
Severity ?
EPSS score ?
Summary
In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible using object injection via insecure expression evaluation.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Progress Software | Telerik Reporting |
Version: 18.2.24.806 < 18.2.24.924 |
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:a:progress_software:telerik_reporting:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "telerik_reporting", "vendor": "progress_software", "versions": [ { "lessThan": "18.2.24.924", "status": "affected", "version": "18.2.24.806", "versionType": "custom" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-8048", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-10-09T16:01:30.452924Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-10-09T16:02:57.533Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "modules": [ "Standalone Desktop Report Designer" ], "platforms": [ "Windows" ], "product": "Telerik Reporting", "vendor": "Progress Software", "versions": [ { "lessThan": "18.2.24.924", "status": "affected", "version": "18.2.24.806", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Markus Wulftange with CODE WHITE GmbH." } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible using object injection via insecure expression evaluation.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e" } ], "value": "In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible using object injection via insecure expression evaluation." } ], "impacts": [ { "capecId": "CAPEC-586", "descriptions": [ { "lang": "en", "value": "CAPEC-586 Object Injection" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-470", "description": "CWE-470 Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-09T14:18:56.968Z", "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware" }, "references": [ { "url": "https://docs.telerik.com/reporting/knowledge-base/insecure-expression-evaluation-cve-2024-8048" } ], "source": { "discovery": "UNKNOWN" }, "title": "Telerik Reporting Insecure Expression Evaluation", "x_generator": { "engine": "Vulnogram 0.2.0" } } }, "cveMetadata": { "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "assignerShortName": "ProgressSoftware", "cveId": "CVE-2024-8048", "datePublished": "2024-10-09T14:18:56.968Z", "dateReserved": "2024-08-21T17:18:57.546Z", "dateUpdated": "2024-10-09T16:02:57.533Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-8014
Vulnerability from cvelistv5
Published
2024-10-09 14:16
Modified
2024-10-09 16:05
Severity ?
EPSS score ?
Summary
In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible through object injection via an insecure type resolution vulnerability.
References
▼ | URL | Tags |
---|---|---|
https://docs.telerik.com/reporting/knowledge-base/insecure-type-resolution-cve-2024-8014 | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Progress Software | Telerik Reporting |
Version: 18.2.24.806 < 18.2.24.924 |
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:a:progress_software:telerik_reporting:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "telerik_reporting", "vendor": "progress_software", "versions": [ { "lessThan": "18.2.24.924", "status": "affected", "version": "18.2.24.806", "versionType": "custom" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-8014", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-10-09T16:04:54.577886Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-10-09T16:05:56.794Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Telerik Reporting", "vendor": "Progress Software", "versions": [ { "lessThan": "18.2.24.924", "status": "affected", "version": "18.2.24.806", "versionType": "custom" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Markus Wulftange with CODE WHITE GmbH." } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible through object injection via an insecure type resolution vulnerability.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e" } ], "value": "In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible through object injection via an insecure type resolution vulnerability." } ], "impacts": [ { "capecId": "CAPEC-586", "descriptions": [ { "lang": "en", "value": "CAPEC-586 Object Injection" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-470", "description": "CWE-470 Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-09T14:16:33.764Z", "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware" }, "references": [ { "tags": [ "vendor-advisory" ], "url": "https://docs.telerik.com/reporting/knowledge-base/insecure-type-resolution-cve-2024-8014" } ], "source": { "discovery": "UNKNOWN" }, "title": "Telerik Reporting EntityDataSource Insecure Type Resolution", "x_generator": { "engine": "Vulnogram 0.2.0" } } }, "cveMetadata": { "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "assignerShortName": "ProgressSoftware", "cveId": "CVE-2024-8014", "datePublished": "2024-10-09T14:16:33.764Z", "dateReserved": "2024-08-20T16:06:14.930Z", "dateUpdated": "2024-10-09T16:05:56.794Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-7840
Vulnerability from cvelistv5
Published
2024-10-09 14:41
Modified
2024-10-10 14:57
Severity ?
EPSS score ?
Summary
In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a command injection attack is possible through improper neutralization of hyperlink elements.
References
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Progress Software | Telerik Reporting |
Version: 18.2.24.806 < 18.2.24.924 |
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:a:progress:telerik_reporting:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "telerik_reporting", "vendor": "progress", "versions": [ { "lessThan": "18.2.24.924", "status": "affected", "version": "18.2.24.806", "versionType": "custom" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-7840", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-10-09T16:15:28.274791Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-10-09T16:26:04.365Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "platforms": [ "Windows" ], "product": "Telerik Reporting", "vendor": "Progress Software", "versions": [ { "lessThan": "18.2.24.924", "status": "affected", "version": "18.2.24.806", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a command injection attack is possible through improper neutralization of hyperlink elements." } ], "value": "In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a command injection attack is possible through improper neutralization of hyperlink elements." } ], "impacts": [ { "capecId": "CAPEC-248", "descriptions": [ { "lang": "en", "value": "CAPEC-248 Command Injection" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-77", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-10T14:57:12.659Z", "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware" }, "references": [ { "url": "https://docs.telerik.com/reporting/knowledge-base/command-injection-cve-2024-7840" } ], "source": { "discovery": "UNKNOWN" }, "title": "Improper neutralization special element in hyperlinks", "x_generator": { "engine": "Vulnogram 0.2.0" } } }, "cveMetadata": { "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "assignerShortName": "ProgressSoftware", "cveId": "CVE-2024-7840", "datePublished": "2024-10-09T14:41:40.048Z", "dateReserved": "2024-08-15T14:49:50.454Z", "dateUpdated": "2024-10-10T14:57:12.659Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-0832
Vulnerability from cvelistv5
Published
2024-01-31 15:14
Modified
2024-08-23 18:18
Severity ?
EPSS score ?
Summary
In Telerik Reporting versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component. In an environment where an existing Telerik Reporting install is present, a lower privileged user has the ability to manipulate the installation package to elevate their privileges on the underlying operating system.
References
▼ | URL | Tags |
---|---|---|
https://www.telerik.com/products/reporting.aspx | product | |
https://docs.telerik.com/reporting/knowledge-base/legacy-installer-vulnerability | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Progress Software | Telerik Reporting |
Version: 1.0 ≤ |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T18:18:18.701Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "product", "x_transferred" ], "url": "https://www.telerik.com/products/reporting.aspx" }, { "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://docs.telerik.com/reporting/knowledge-base/legacy-installer-vulnerability" } ], "title": "CVE Program Container" }, { "affected": [ { "cpes": [ "cpe:2.3:a:progress_software:telerik_reporting:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "telerik_reporting", "vendor": "progress_software", "versions": [ { "lessThan": "2024-r1", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-0832", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-08-23T18:04:12.382385Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-08-23T18:18:34.073Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "affected", "modules": [ "Telerik Reporting Installer" ], "product": "Telerik Reporting", "vendor": "Progress Software", "versions": [ { "lessThan": "2024 R1", "status": "affected", "version": "1.0", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Lockheed Martin Red Team" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "In Telerik Reporting versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component.\u0026nbsp; In an environment where an existing Telerik Reporting install is present, a lower privileged user has the ability to manipulate the installation package to elevate their privileges on the underlying operating system." } ], "value": "In Telerik Reporting versions prior to 2024 R1, a privilege elevation vulnerability has been identified in the applications installer component.\u00a0 In an environment where an existing Telerik Reporting install is present, a lower privileged user has the ability to manipulate the installation package to elevate their privileges on the underlying operating system." } ], "impacts": [ { "capecId": "CAPEC-233", "descriptions": [ { "lang": "en", "value": "CAPEC-233 Privilege Escalation" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-31T16:47:23.600Z", "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware" }, "references": [ { "tags": [ "product" ], "url": "https://www.telerik.com/products/reporting.aspx" }, { "tags": [ "vendor-advisory" ], "url": "https://docs.telerik.com/reporting/knowledge-base/legacy-installer-vulnerability" } ], "source": { "discovery": "UNKNOWN" }, "title": "Privilege Elevation via Telerik Reporting Installer", "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "assignerShortName": "ProgressSoftware", "cveId": "CVE-2024-0832", "datePublished": "2024-01-31T15:14:44.556Z", "dateReserved": "2024-01-23T17:59:53.748Z", "dateUpdated": "2024-08-23T18:18:34.073Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-8015
Vulnerability from cvelistv5
Published
2024-10-09 14:49
Modified
2024-10-09 16:06
Severity ?
EPSS score ?
Summary
In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability.
References
▼ | URL | Tags |
---|---|---|
https://docs.telerik.com/report-server/knowledge-base/insecure-type-resolution-cve-2024-8015 | vendor-advisory |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Progress Software | Telerik Reporting |
Version: 1.0.0.0 < 10.2.24.924 |
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:a:progress_software:telerik_reporting:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "telerik_reporting", "vendor": "progress_software", "versions": [ { "lessThan": "10.2.24.924", "status": "affected", "version": "1.0.0.0", "versionType": "custom" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-8015", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-10-09T16:04:21.526771Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-10-09T16:06:49.209Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "Telerik Reporting", "vendor": "Progress Software", "versions": [ { "lessThan": "10.2.24.924", "status": "affected", "version": "1.0.0.0", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability." } ], "value": "In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability." } ], "impacts": [ { "capecId": "CAPEC-586", "descriptions": [ { "lang": "en", "value": "CAPEC-586 Object Injection" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-470", "description": "CWE-470 Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-09T14:49:19.603Z", "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware" }, "references": [ { "tags": [ "vendor-advisory" ], "url": "https://docs.telerik.com/report-server/knowledge-base/insecure-type-resolution-cve-2024-8015" } ], "source": { "discovery": "UNKNOWN" }, "title": "Telerik Report Server Insecure Type Resolution", "x_generator": { "engine": "Vulnogram 0.2.0" } } }, "cveMetadata": { "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "assignerShortName": "ProgressSoftware", "cveId": "CVE-2024-8015", "datePublished": "2024-10-09T14:49:19.603Z", "dateReserved": "2024-08-20T16:06:35.623Z", "dateUpdated": "2024-10-09T16:06:49.209Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }