CVE-2024-4357: Progress Telerik Reporting

Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days.

An information disclosure vulnerability exists in Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, allows low-privilege attacker to read systems file via XML External Entity Processing.

Affected products

• Progress Telerik Reporting: before 10.1.24.514 (fixed in 10.1.24.514)

Published 2024-05-15. Last modified 2026-06-17.