---
cve: "CVE-2024-8015"
severity: "CRITICAL"
cvss: 9.1
epss: "0.8%"
vendor: "Progress Software"
kev: false
exploited: false
published: "2024-10-09 15:15:17"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T13:34:32+01:00"
---

# CVE-2024-8015

> 9.1 CRITICAL

## Beschreibung

In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability.

## CNA-Record (Kanon, cvelistV5)

- CNA: **ProgressSoftware**
- State: PUBLISHED
- Stand: 2024-10-09 16:06:49
- CNA-CVSS: **9.1** (`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Hoch | good |
| UI Interaktion | Keine | bad |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-470** — Use of Externally-Controlled Input to Select Classes or Code
  The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

## Angriffsmuster (CAPEC)

- [CAPEC-138 — Reflection Injection](https://capec.mitre.org/data/definitions/138.html) _(Severity: Very High)_

## BSI-Hinweise (deutsch)

- [Progress Software Telerik Report Server: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2024-3158) — _BSI-Einstufung: hoch_
  Ein entfernter Angreifer kann mehrere Schwachstellen in Progress Software Telerik Report Server ausnutzen, um Informationen offenzulegen, beliebigen Code auszuführen oder die Authentifizierung zu umgehen.

## Referenzen

- <https://docs.telerik.com/report-server/knowledge-base/insecure-type-resolution-cve-2024-8015>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2024-8015/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_