CVE-2017-9248
CriticalActively exploited (CISA KEV)
Description
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Progress ASP.NET AJAX and Sitefinity
PublishedJul 3, 2017
First seenJul 3, 2017
Added to KEVNov 3, 2021
Weakness typeCWE-522CWE-522
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: May 3, 2022Update
- progress sitefinity10.0.6412.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| progress sitefinity | v < 10.0.6412.0 | 10.0.6412.0 |
| telerik ui_for_asp.net_ajax | v ≤ 2017.2.503 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.