CVE-2024-7294: 
Progress Telerik Reporting vulnerability analysis and mitigation

In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), an HTTP Denial of Service (DoS) vulnerability was identified, tracked as CVE-2024-7294. The vulnerability affects anonymous endpoints that lack rate limiting functionality (NVD, Vendor Advisory).

The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption) and has received a CVSS v3.1 base score of 6.5 (MEDIUM) from NIST with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. Progress Software Corporation assigned a higher CVSS score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

The vulnerability allows attackers to perform Denial-of-Service (DoS) attacks against anonymous endpoints in the Telerik Report Server. This could potentially disrupt the availability of the reporting service for legitimate users (Security Online).

The vulnerability can be exploited remotely through network access to anonymous endpoints without requiring authentication. The attack complexity is considered low according to NIST's assessment (NVD).

Progress Software has released version 2024 Q3 (10.2.24.806) to address this vulnerability. Users are strongly recommended to upgrade to this version to mitigate the security risk. The fix can be obtained through the Product Downloads section in the customer account portal (Vendor Advisory).