Medium severity · published May 15, 2024
CVE-2024-4837
Trust Boundary Violation Vulnerability
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via a trust boundary violation vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
Telerik Report Server · Progress Software
1.0.0.0 before 10.1.24.514 · source: vendor, NVD
TR
Telerik Reporting · Progress
1.0.0.0 through 10.0.24.305 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-4837
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-4837
Vendor Advisory
https://docs.telerik.com/report-server/knowledge-base/information-exposure-cve-2024-4837
More from Telerik Report Server
9.8
CVE-2024-4358
Registration Authentication Bypass Vulnerability
8.9
CVE-2026-106155
Stored Cross-site Scripting (XSS) in Telerik Report Server Web Report Viewers
8.8
CVE-2024-7292
Account Controller allows high count of login attempts
7.1
CVE-2026-106145
Privilege Escalation in Telerik Report Server Service-Agent Hub
6.5
CVE-2025-0556
Telerik Report Server Clear Text Transmission of Agent Commands