Skip to content

Commit e853282

Browse files
ighristovighristov
authored
docs: added 4 CVE KBs (#206)
CVE list: - 2024-7292 - 2024-7293 - 2024-7294 - 2024-8015
1 parent 89f5871 commit e853282

4 files changed

+193
-0
lines changed

‎knowledge-base/improper-restriction-of-excessive-login-attempts-cve-2024-7292.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
---
2+
title: Improper Restriction of Excessive Login Attempts
3+
description: "How to mitigate CVE-2024-7292, an improper restriction of excessive login attempts vulnerability."
4+
slug: improper-restriction-of-excessive-login-attempts-cve-2024-7292
5+
res_type: kb
6+
---
7+
8+
## Description
9+
10+
Product Alert – September 2024 - [CVE-2024-7292](https://www.cve.org/CVERecord?id=CVE-2024-7292)
11+
12+
- Telerik Report Server 2024 Q3 (10.2.24.709) or earlier.
13+
14+
## Issue
15+
16+
CWE-307 Improper Restriction of Excessive Authentication Attempts
17+
18+
### What Are the Impacts
19+
20+
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a credential stuffing attack is possible through improper restriction of excessive login attempts.
21+
22+
## Solution
23+
24+
We have addressed the issue and the Progress® Telerik® team recommends performing an upgrade to the version listed in the table below.
25+
26+
| Current Version | Guidance |
27+
|-----------------|----------|
28+
| 2024 Q3 (10.2.24.709) or earlier | Update to 2024 Q3 (10.2.24.806) ([update instructions](({%slug upgrade%}))) |
29+
30+
All customers who have a Telerik Report Server license can access the downloads here [Product Downloads | Your Account](https://www.telerik.com/account/downloads/product-download?product=REPSERVER).
31+
32+
## Notes
33+
34+
- You can check what version you are running by:
35+
1. Go to your Report Server web UI and log in using an account with administrator rights.
36+
1. Open the Configuration page (`~/Configuration/Index`).
37+
1. Select the About tab, the version number is displayed in the pane on the right.
38+
- If you have any questions or concerns related to this issue, open a new Technical Support case in [Your Account | Support Center](https://www.telerik.com/account/support-center/contact-us/). Technical Support is available to Telerik customers with an active support plan.
39+
40+
## External References
41+
42+
[CVE-2024-7292](https://www.cve.org/CVERecord?id=CVE-2024-7292) (HIGH)
43+
44+
**CVSS:** 7.5
45+
46+
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a credential stuffing attack is possible through improper restriction of excessive login attempts.

‎knowledge-base/insecure-type-resolution-cve-2024-8015.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
title: Insecure Type Resolution Vulnerability
3+
description: "How to mitigate CVE-2024-8015, an insecure type resolution vulnerability."
4+
slug: insecure-type-resolution-cve-2024-8015
5+
res_type: kb
6+
---
7+
8+
## Description
9+
10+
Product Alert – September 2024 - [CVE-2024-8015](https://www.cve.org/CVERecord?id=CVE-2024-8015)
11+
12+
- Telerik Reporting 2024 Q3 (10.2.24.806) or earlier.
13+
14+
## Issue
15+
16+
CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
17+
18+
### What Are the Impacts
19+
20+
In Progress® Telerik® Report Server, versions 2024 Q3 (10.2.24.806) or earlier, a code execution attack is possible through an insecure type resolution vulnerability.
21+
22+
## Solution
23+
24+
We have addressed the issue and the Progress® Telerik® team recommends performing an upgrade to the version listed in the table below.
25+
26+
| Current Version | Guidance |
27+
|-----------------|----------|
28+
| 2024 Q3 (10.2.24.806) or earlier | Update to 2024 Q3 (10.2.24.924) ([update instructions](({%slug upgrade%}))) |
29+
30+
All customers who have a Telerik Reporting license can access the downloads here [Product Downloads | Your Account](https://www.telerik.com/account/downloads/product-download?product=REPSERVER).
31+
32+
## Temporary Mitigation
33+
34+
You can mitigate this vulnerability by changing Report Server’s Application Pool user to one with limited permissions.
35+
36+
If you do not already have a procedure for creating a dedicated App Pool user, you can reference our [How To Change IIS User for Report Server](https://docs.telerik.com/report-server/knowledge-base/how-to-change-report-server-iis-user) KB article for additional assistance.
37+
38+
## Notes
39+
40+
- You can check what version you are running by:
41+
1. Go to your Report Server web UI and log in using an account with administrator rights.
42+
1. Open the Configuration page (`~/Configuration/Index`).
43+
1. Select the About tab, the version number is displayed in the pane on the right.
44+
- If you have any questions or concerns related to this issue, open a new Technical Support case in [Your Account | Support Center](https://www.telerik.com/account/support-center/contact-us/). Technical Support is available to Telerik customers with an active support plan.
45+
- We would like to thank Markus Wulftange with CODE WHITE GmbH for their responsible disclosure and cooperation with CVE-2024-8014.
46+
47+
## External References
48+
49+
[CVE-2024-8015](https://www.cve.org/CVERecord?id=CVE-2024-8015) (CRITICAL)
50+
51+
**CVSS:** 9.1
52+
53+
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.924), a code execution attack is possible through object injection via an insecure type resolution vulnerability.
54+
55+
Discoverer Credit: Markus Wulftange with CODE WHITE GmbH

‎knowledge-base/uncontrolled-resource-consumption-cve-2024-7294.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
---
2+
title: Uncontrolled Resource Consumption
3+
description: "How to mitigate CVE-2024-7294, an anonymous endpoints DoS vulnerability."
4+
slug: uncontrolled-resource-consumption-cve-2024-7294
5+
res_type: kb
6+
---
7+
8+
## Description
9+
10+
Product Alert – September 2024 - [CVE-2024-7294](https://www.cve.org/CVERecord?id=CVE-2024-7294)
11+
12+
- Telerik Report Server 2024 Q3 (10.2.24.709) or earlier.
13+
14+
## Issue
15+
16+
CWE-400 Uncontrolled Resource Consumption
17+
18+
### What Are the Impacts
19+
20+
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), an HTTP DoS attack is possible on anonymous endpoints without rate limiting.
21+
22+
## Solution
23+
24+
We have addressed the issue and the Progress® Telerik® team recommends performing an upgrade to the version listed in the table below.
25+
26+
| Current Version | Guidance |
27+
|-----------------|----------|
28+
| 2024 Q3 (10.2.24.709) or earlier | Update to 2024 Q3 (10.2.24.806) ([update instructions](({%slug upgrade%}))) |
29+
30+
All customers who have a Telerik Report Server license can access the downloads here [Product Downloads | Your Account](https://www.telerik.com/account/downloads/product-download?product=REPSERVER).
31+
32+
## Notes
33+
34+
- You can check what version you are running by:
35+
1. Go to your Report Server web UI and log in using an account with administrator rights.
36+
1. Open the Configuration page (`~/Configuration/Index`).
37+
1. Select the About tab, the version number is displayed in the pane on the right.
38+
- If you have any questions or concerns related to this issue, open a new Technical Support case in [Your Account | Support Center](https://www.telerik.com/account/support-center/contact-us/). Technical Support is available to Telerik customers with an active support plan.
39+
40+
## External References
41+
42+
[CVE-2024-7294](https://www.cve.org/CVERecord?id=CVE-2024-7294) (HIGH)
43+
44+
**CVSS:** 7.5
45+
46+
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), an HTTP DoS attack is possible on anonymous endpoints without rate limiting.

‎knowledge-base/weak-password-requirement-cve-2024-7293.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
---
2+
title: Weak Password Requirement
3+
description: "How to mitigate CVE-2024-7293, a weak password requirement vulnerability."
4+
slug: weak-password-requirement-cve-2024-7293
5+
res_type: kb
6+
---
7+
8+
## Description
9+
10+
Product Alert – September 2024 - [CVE-2024-7293](https://www.cve.org/CVERecord?id=CVE-2024-7293)
11+
12+
- Telerik Report Server 2024 Q3 (10.2.24.709) or earlier.
13+
14+
## Issue
15+
16+
CWE-521 Weak Password Requirements
17+
18+
### What Are the Impacts
19+
20+
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a password brute forcing attack is possible through weak password requirements enforced by Report Server.
21+
22+
## Solution
23+
24+
We have addressed the issue and the Progress® Telerik® team recommends performing an upgrade to the version listed in the table below.
25+
26+
| Current Version | Guidance |
27+
|-----------------|----------|
28+
| 2024 Q3 (10.2.24.709) or earlier | Update to 2024 Q3 (10.2.24.806) ([update instructions](({%slug upgrade%}))) |
29+
30+
All customers who have a Telerik Report Server license can access the downloads here [Product Downloads | Your Account](https://www.telerik.com/account/downloads/product-download?product=REPSERVER).
31+
32+
## Notes
33+
34+
- You can check what version you are running by:
35+
1. Go to your Report Server web UI and log in using an account with administrator rights.
36+
1. Open the Configuration page (`~/Configuration/Index`).
37+
1. Select the About tab, the version number is displayed in the pane on the right.
38+
- If you have any questions or concerns related to this issue, open a new Technical Support case in [Your Account | Support Center](https://www.telerik.com/account/support-center/contact-us/). Technical Support is available to Telerik customers with an active support plan.
39+
40+
## External References
41+
42+
[CVE-2024-7293](https://www.cve.org/CVERecord?id=CVE-2024-7293) (HIGH)
43+
44+
**CVSS:** 7.5
45+
46+
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a password brute forcing attack is possible through weak password requirements.

0 commit comments

Comments
 (0)