Telerik Report Server
Monthly
Stored cross-site scripting in Progress Telerik Report Server versions prior to 12.2.26.1007 allows an authenticated report author to execute arbitrary script in another user's session by embedding javascript: or vbscript: URLs in report navigation actions or HTML text-box links. When a higher-privilege user, such as an administrator, views the malicious report and triggers the embedded navigation, the script runs in the web report viewer's origin, enabling privilege escalation in multi-user deployments. The vulnerability has a CVSS score of 8.9, requires authentication and user interaction, and no public exploit has been identified at time of analysis.
Incorrect privilege assignment in Progress Telerik Report Server (versions prior to 12.2.26.1007) lets an authenticated user, including a low-privilege or guest account with a valid bearer token, register as a trusted service agent through the service-agent SignalR hub. On the next server settings-synchronization event, the rogue agent receives storage settings and encryption private keys, enabling disclosure of stored data-source credentials and connection strings, impersonation of legitimate agents, and interference with task dispatch. No public exploit code has been identified at time of analysis, and exploitation requires the attacker to persist until the synchronization event occurs.
In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communication of non-sensitive information between the service agent. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Progress® Telerik® Report Server versions prior to 2024 Q4 (10.3.24.1112), the encryption of local asset data used an older algorithm which may allow a sophisticated actor to decrypt this. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a credential stuffing attack is possible through improper restriction of excessive login attempts. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Progress® Telerik® Report Server versions prior to 2024 Q2 (10.1.24.709), a remote code execution attack is possible through an insecure deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via a trust boundary. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting in Progress Telerik Report Server versions prior to 12.2.26.1007 allows an authenticated report author to execute arbitrary script in another user's session by embedding javascript: or vbscript: URLs in report navigation actions or HTML text-box links. When a higher-privilege user, such as an administrator, views the malicious report and triggers the embedded navigation, the script runs in the web report viewer's origin, enabling privilege escalation in multi-user deployments. The vulnerability has a CVSS score of 8.9, requires authentication and user interaction, and no public exploit has been identified at time of analysis.
Incorrect privilege assignment in Progress Telerik Report Server (versions prior to 12.2.26.1007) lets an authenticated user, including a low-privilege or guest account with a valid bearer token, register as a trusted service agent through the service-agent SignalR hub. On the next server settings-synchronization event, the rogue agent receives storage settings and encryption private keys, enabling disclosure of stored data-source credentials and connection strings, impersonation of legitimate agents, and interference with task dispatch. No public exploit code has been identified at time of analysis, and exploitation requires the attacker to persist until the synchronization event occurs.
In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communication of non-sensitive information between the service agent. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Progress® Telerik® Report Server versions prior to 2024 Q4 (10.3.24.1112), the encryption of local asset data used an older algorithm which may allow a sophisticated actor to decrypt this. Rated medium severity (CVSS 6.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a credential stuffing attack is possible through improper restriction of excessive login attempts. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Progress® Telerik® Report Server versions prior to 2024 Q2 (10.1.24.709), a remote code execution attack is possible through an insecure deserialization vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via a trust boundary. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.