CVE-2024-4837: 
Telerik Report Server vulnerability analysis and mitigation

Telerik Report Server version 2024 Q1 (10.0.24.305) and earlier, running on IIS, contains a trust boundary violation vulnerability (CVE-2024-4837). This vulnerability allows an unauthenticated attacker to gain access to Telerik Report Server restricted functionality (CVE Mitre, Telerik Docs).

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) with a CVSS score of 5.3. The issue specifically affects the storage settings of the Report Server when deployed on IIS environments (Telerik Docs).

While storage settings are typically not accessible outside the Report Server environment, an attacker who gains access to these settings could potentially interfere with the Report Server's operation by corrupting the settings. If the server is misconfigured to use external options with plain text credentials, these could be exposed to unauthorized users (Telerik Docs).

The only recommended mitigation is to update to Telerik Report Server version 2024 Q2 (10.1.24.514) or later. Users with an active Telerik Report Server license can access the updates through their account's Product Downloads section (Telerik Docs).

The vulnerability was discovered and reported by Christian Kuersteiner from Greenbone AG via BugCrowd (Telerik Docs).