CVE-2024-4837 Trust Boundary Violation Vulnerability
Unauthenticated attackers can bypass trust boundaries to access restricted functionality in Telerik Report Server on IIS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-4837?
CVE-2024-4837 is a medium-severity authentication bypass vulnerability in Progress Software Telerik Report Server, published on 15 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via a trust boundary violation vulnerability.
Weakness: CWE-200
Which versions are affected by CVE-2024-4837?
It affects 1 product.
Products include Progress Telerik Report Server.
How do I fix CVE-2024-4837?
No fix has been published for CVE-2024-4837 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-4837 being exploited?
There is no known exploitation of CVE-2024-4837 in the wild and no public exploit code.
Other vulnerabilities in Progress Software Telerik Report Server
- CVE-2024-6327 Progress Telerik Report Server Deserialization
- CVE-2024-1800 Progress Telerik Report Server Deserialization
- CVE-2024-8015 Telerik Report Server Insecure Type Resolution
- CVE-2025-0556 Telerik Report Server Clear Text Transmission of Agent Commands
- CVE-2024-7292 Account Controller allows high count of login attempts
Sources
Also known as GHSA-856w-rm82-4hp7.