In Progress® Telerik® Report Server, versions prior to 2025 Q1 (11.0.25.211) when using the older .NET Framework implementation, communication of non-sensitive information between the service agent process and app host process occurs over an unencrypted tunnel, which can be subjected to local network traffic sniffing.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HProgress Telerik Report Server
APPProgress< 11.0.25.211
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
Related vulnerabilities
CVE-2024-8015CRITICAL9.1PL ✓ten sam produkt
RCE w Progress Telerik Report Server przez insecure type resolution
CVE-2024-6327CRITICAL9.9PL ✓ten sam produkt
RCE przez insecure deserialization w Progress Telerik Report Server
CVE-2024-1800CRITICAL9.9PL ✓ten sam produkt
RCE przez insecure deserialization w Progress Telerik Report Server
CVE-2024-7295HIGH7.1ten sam produkt
In Progress® Telerik® Report Server versions prior to 2024 Q4 (10.3.24.1112), the encryption of local asset da...
CVE-2024-7292HIGH7.5ten sam produkt
In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a credential stuffing attack is p...