CVE-2019-18935
CriticalActively exploited (CISA KEV)Known to be used in ransomware campaigns
Description
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)
SeverityCritical
CVSS9.8
Exploit probability—
Product
Progress Telerik UI for ASP.NET AJAX
PublishedDec 11, 2019
First seenDec 11, 2019
Added to KEVNov 3, 2021
Weakness typeCWE-502Deserialization of untrusted data
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: May 3, 2022Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| telerik ui_for_asp.net_ajax | 2011.1.315 ≤ v ≤ 2020.1.114 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.