vulnwire
9.8crit

CVE-2017-9248KEVin critical feed1 exploit

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect T…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.1 · CNA
CISA KEV
Yes
added 2021-11-03
EPSS
75.1%
percentile 100%
Public exploits
1
Exploit-DB

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.

Known exploited (CISA KEV)

Added
5 y ago
Due date
2022-05-03 (4 y ago)
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Vendor / product
Progress / ASP.NET AJAX and Sitefinity
CISA name
Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability

CISA SSVC assessment

Exploitation
Active — exploited in the wild
Automatable
yes
Technical impact
total
Assessed
20 mo ago

Exploit prediction (EPSS)

75.10% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • EDB-43873 Telerik UI for ASP.NET AJAX 2012.3.1308 < 2017.1.118 - Encryption Keys Disclosure · webapps · 2018-01-24

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-522 Insufficiently Protected Credentials

References

  • telerik.com /support/kb/aspnet-ajax/details/cryptographic-weakness · x_refsource_CONFIRM, x_transferred
  • exploit-db.com /exploits/43873/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • telerik.com /blogs/security-alert-for-telerik-ui-for-asp.net-ajax-and-progress-sitefinity · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/99965 · vdb-entry, x_refsource_BID, x_transferred
  • cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9248 · government-resource

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.