Assigner | ProgressSoftware |
Reserved | 2024-04-30 |
Published | 2024-05-15 |
Updated | 2024-06-04 |
Description
An information disclosure vulnerability exists in Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, allows low-privilege attacker to read systems file via XML External Entity Processing.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Problem types
CWE-611 Improper Restriction of XML External Entity Reference
Product status
1.0.0.0 before 10.0.24.514
Credits
Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) working with Trend Micro Zero Day Initiative
References
https://docs.telerik.com/report-server/knowledge-base/xxe-vulnerability-cve-2024-4357