Authentication Bypass Vulnerability in Progress Telerik Report Server

What changed

Progress Telerik Report Server has been found to contain a significant security flaw that allows unauthenticated attackers to bypass authentication mechanisms. This vulnerability affects versions 2024 Q1 (10.0.24.305) and earlier, specifically when hosted on IIS.

The flaw can lead to unauthorized access to restricted functionalities, posing a serious risk to the integrity and confidentiality of the data managed by the server.

Who is affected

The vulnerability impacts a range of users and organizations utilizing Progress Telerik Report Server in their operations. Key affected parties include:

Organizations that rely on Progress Telerik Report Server for reporting and data visualization.

• Users of Progress Telerik Report Server version 2024 Q1 (10.0.24.305) or earlier.
• Businesses utilizing IIS for hosting their Telerik Report Server applications.
• Developers and IT departments responsible for maintaining security in applications using Telerik products.

What to do

Organizations using the affected versions of Progress Telerik Report Server should take immediate action to mitigate risks associated with this vulnerability. It is crucial to ensure that systems are updated and secured against potential exploitation.

Monitoring for unusual activity and implementing additional security measures can help protect sensitive data.

• Upgrade to the latest version of Progress Telerik Report Server to patch the vulnerability.
• Review security configurations on IIS to ensure they are properly set up.
• Conduct a security audit to assess potential exposure and implement necessary controls.