Encryption Weakness (7295)
Description
Product Alert - November 2024 - CVE-2024-7295
- Telerik Report Server 2024 Q3 (10.2.24.924) or earlier.
Issue
CWE-798 Use of Hard-coded Credentials
What Are the Impacts
In Progress® Telerik® Report Server versions prior to 2024 Q4 (10.3.24.1112), the encryption of local asset data used an older algorithm which may allow a sophisticated actor to decrypt this information.
Solution
We have addressed the issue and the Progress Telerik team recommends performing an upgrade to the version listed in the table below.
| Current Version | Guidance |
|---|---|
| 2024 Q3 (10.2.24.924) or earlier | Update to 2024 Q4 (10.3.24.1112) (update instructions) |
All customers who have a Telerik Report Server license can access the downloads here Product Downloads | Your Account.
Notes
- You can check what version you are running by:
- Go to your Report Server web UI and log in using an account with administrator rights.
- Open the Configuration page (
~/Configuration/Index). - Select the About tab, the version number is displayed in the pane on the right.
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to Telerik customers with an active support plan.
External References
CVE-2024-7295 (HIGH)
CVSS: 7.1
In Progress® Telerik® Report Server versions prior to 2024 Q4 (10.3.24.1112), the encryption of local asset data used an older algorithm which may allow a sophisticated actor to decrypt this information.