Improper neutralization special element in hyperlinks

CVE-2024-7840
7.8HIGH

Key Information

Vendor
Progress Software
Status
Telerik Reporting
Vendor
CVE Published:
9 October 2024

Summary

In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a command injection attack is possible through improper neutralization of hyperlink elements.

Affected Version(s)

Telerik Reporting < 18.2.24.924

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Risk change from: null to: 7.8 - (HIGH)

  • Vulnerability published.

Collectors

NVD DatabaseMitre Database
.