peter bassill · operator
$ cve CVE-2017-9248 JSON

CVE-2017-9248 KEV EXPLOIT

9.8
CRITICAL · CVSS 3.1 · EPSS 75.1% (pctl 99)

Patch first

On CISA KEV — known exploited in the wild, due 2022-05-03.

Description

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS75.1% — more likely to be exploited than 99% of all CVEs
WeaknessCWE-522
On CISA KEVyes — remediate by 2022-05-03
Public exploityes
Published2017-07-03
Last modified2026-06-17

CISA KEV

NameProgress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability
Added2021-11-03
Due2022-05-03
Vendor / productProgress / ASP.NET AJAX and Sitefinity
Ransomware usenone reported

Affected (2)

VendorProduct
progresssitefinity
telerikui for asp.net ajax

Public exploits

SourceTitleDate
exploit-dbTelerik UI for ASP.NET AJAX 2012.3.1308 < 2017.1.118 - Encryption Keys Disclosure2018-01-24

References

→ the Explorer  ·  watch your stack  ·  NVD