CVE-2017-9248
CRITICAL CISA KEV EPSS 99.4%
Published Jul 3, 20178y ago · Modified Jun 17, 20262w ago
9.8 CVSS 3.1
Published Jul 3, 2017 8y ago
Last Modified Jun 17, 2026 2w ago
KEV Listed Nov 3, 2021 4y ago
KEV Due May 3, 2022 1520d overdue
Description
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
CISA Known Exploited Overdue 1520d
- Added
- Nov 3, 2021
- Due
- May 3, 2022
Apply updates per vendor instructions.
EPSS Exploit Probability
99.4% percentile
Exploit & Patch Status
Actively Exploited (KEV)
No Patch Available
Weaknesses 1
CWE-522
Affected Products 2
References 5
- securityfocus.com http://www.securityfocus.com/bid/99965
- telerik.com http://www.telerik.com/blogs/security-alert-for-telerik-ui-for-asp.net-ajax-and-progress-sitefinity
- telerik.com http://www.telerik.com/support/kb/aspnet-ajax/details/cryptographic-weakness
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9248
- exploit-db.com https://www.exploit-db.com/exploits/43873/
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.