Improper neutralization special element in hyperlinks
CVE-2024-7840

7.8HIGH

Key Information:

Vendor

Progress Software
Status
Telerik Reporting
Vendor
CVE Published:
9 October 2024

What is CVE-2024-7840?

In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a serious command injection vulnerability is introduced due to the improper neutralization of hyperlink elements. This flaw can allow an attacker to execute arbitrary commands on the server by exploiting vulnerable processing of link inputs. To mitigate potential risks, it is essential for users to update to the latest version of Telerik Reporting and follow security best practices to protect their applications.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Telerik Reporting Windows 18.2.24.806 < 18.2.24.924

References

https://docs.telerik.com/reporting/knowledge-base/command...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.