CVE-2024-7293 is a high severity (CVSS 7.5) weakness in Progress Telerik Report Server. Its password requirements are too weak, which makes password brute forcing practical. Telerik fixed it in 2024 Q3 (10.2.24.806), so upgrade and then reset weak passwords.
What's affected
The NVD record says versions prior to 2024 Q3 (10.2.24.806) are affected. Telerik's article says Report Server 2024 Q3 (10.2.24.709) and earlier are affected. These agree, and both give 7.5 as the score.
One detail to be aware of: the record's product list names the Telerik Reporting CPE rather than Report Server. The description and the Telerik article both talk about Report Server, so that is the product to patch. If you also use the Telerik Reporting library in your own applications, check the vendor page for your version rather than assuming it is unaffected.
The weakness is CWE-521, weak password requirements. The vector is AV:N/AC:H/PR:N/UI:R.
Telerik lists no workaround.
How to check if you're exposed
Telerik explains how to confirm the build. Log in as an administrator, open ~/Configuration/Index on your Report Server, and choose the About tab. A build of 10.2.24.709 or older is affected.
Then audit the accounts themselves. Weak requirements mean the damage depends on what your users already chose. Check how many accounts use short passwords, default passwords, or a shared password. If your server uses local accounts and not single sign on, this matters more.
What to do now
- Upgrade to 2024 Q3 (10.2.24.806) following the Implementer Guide. Downloads are on the Product Downloads page of your Telerik account.
- After upgrading, require users with old weak passwords to set new ones. A fix to the policy does not change passwords that already exist.
- Prefer single sign on or another central identity provider, so password strength is enforced in one place.
- Limit who can reach the Report Server login page, using a VPN, allow list or reverse proxy.
- Fix CVE-2024-7292 in the same change, since it covers the missing login attempt limits and ships in the same build.
Why it matters
Brute forcing is simple arithmetic. A short or common password falls quickly to automated guessing, and the two Telerik issues compound each other. CVE-2024-7292 means the server did not slow guessing down, and CVE-2024-7293 means the passwords being guessed could be weak.
Report Server often stores data source connection details and business reports. Taking over an account can expose that content. The record does not mark this CVE as a CISA Known Exploited Vulnerability, and Telerik does not claim exploitation in the wild.
Policy flaws like this one are easy to overlook because they are not a code bug in the usual sense. They show up in questionnaires and audits more than in scanners. Keep deployed server products in your asset inventory with their versions, so a notice like this one maps to a list of machines in minutes. The Gold directory is a place to look up other entries for the products you run.
Quick check
Will upgrading force everyone to choose a stronger password?
The Telerik article does not say so. Plan an explicit reset for accounts with weak or old passwords.
Is this the same issue as CVE-2024-7292?
No. CVE-2024-7292 is about missing limits on login attempts. CVE-2024-7293 is about weak password requirements. Both are fixed in the same build.
Sources
Last reviewed: 19 October 2026.
