Improper neutralization special element in hyperlinks
CVE-2024-7840

7.8HIGH

Key Information:

Vendor
Progress Software
Status
Telerik Reporting
Vendor
CVE Published:
9 October 2024

Summary

In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a serious command injection vulnerability is introduced due to the improper neutralization of hyperlink elements. This flaw can allow an attacker to execute arbitrary commands on the server by exploiting vulnerable processing of link inputs. To mitigate potential risks, it is essential for users to update to the latest version of Telerik Reporting and follow security best practices to protect their applications.

Affected Version(s)

Telerik Reporting Windows 18.2.24.806 < 18.2.24.924

References

https://docs.telerik.com/reporting/knowledge-base/command...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

Collectors

NVD DatabaseMitre Database
.