CVE-2024-6096 - CVE House

Status published High CVE-2024-6096

Unsafe Deserialization Vulnerability

8.8 CVSS

Vulnerability Description

In Progress® Telerik® Reporting versions prior to 18.1.24.709, a code execution attack is possible through object injection via an insecure type resolution vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-6096

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Markus Wulftange with CODE WHITE GmbH

References

https://docs.telerik.com/reporting/knowledge-base/unsafe-reflection-CVE-2024-6096

More from Progress Software Corporation

View All →

CVE-2025-8095

Recoverable obfuscation using the OECH1 prefix encoding in OpenEdge

Critical 9.1

CVE-2025-7389

Unauthorized Arbitrary File Read via RMI in AdminServer Interface

High 8.2

CVE-2025-7388

Authenticated Command Injection via configuration parameter manipulation in exposed RMI interface

High 8.4

CVE-2025-2572

WhatsUp Gold NmConfigurationManager.exe database manipulation vulnerability

Medium 5.6

CVE-2025-1968

Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under...

High 7.7

Affected Vendor

Progress Software Corporation

View all reports →

Affected Software

Telerik Reporting

Vulnerable Versions:

1.0.0

Timeline

Official Publish: July 24th, 2024

Last Modified: April 25th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-470

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.