Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Progress Software Telerik Report Server ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen.
Product
Der Telerik Report Server bietet eine Plattform zur Erstellung, Verwaltung und Verteilung von Berichten in einem Unternehmen.
Vulnerabilities 3
-
High 7.5
Account Controller allows high count of login attempts
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a credential stuffing attack is possible through improper restriction of excessive login attempts.
-
High 7.5
Password policy for new users is not strong enough
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a password brute forcing attack is possible through weak password requirements.
-
High 7.5
Uncontrolled resource consumption of anonymous endpoints
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), an HTTP DoS attack is possible on anonymous endpoints without rate limiting.
Revision history
-
#1
Initiale Fassung
References
-
Telerik Security Advisory vom 2024-10-09
https://docs.telerik.com/report-server/knowledge-base/improper-restriction-of-excessive-login-attempts-cve-2024-7292
-
Telerik Security Advisory vom 2024-10-09
https://docs.telerik.com/report-server/knowledge-base/weak-password-requirement-cve-2024-7293
-
Telerik Security Advisory vom 2024-10-09
https://docs.telerik.com/report-server/knowledge-base/uncontrolled-resource-consumption-cve-2024-7294
-
NIST Vulnerability Database vom 2024-10-09
https://nvd.nist.gov/vuln/detail/cve-2024-7292
-
NIST Vulnerability Database vom 2024-10-09
https://nvd.nist.gov/vuln/detail/cve-2024-7293
-
NIST Vulnerability Database vom 2024-10-09
https://nvd.nist.gov/vuln/detail/cve-2024-7294