PT-2017-4156 · Progress · Telerik Ui For Asp.Net Ajax+1
Paul Taylor
·
Publicado
2017-07-03
·
Atualizado
2025-03-14
·
CVE-2017-9248
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Progress Telerik UI for ASP.NET AJAX versions prior to R2 2017 SP1
Sitefinity versions prior to 10.0.6412.0
Description
The issue is related to insufficient protection of registration data in the Telerik.Web.UI.dll library, which is part of the Telerik UI for ASP.NET AJAX and Sitefinity content management system. This weakness can be exploited by a remote attacker to reveal encryption keys, specifically
Telerik.Web.UI.DialogParametersEncryptionKey and/or MachineKey. This can lead to a MachineKey leak, arbitrary file uploads or downloads, cross-site scripting (XSS), or ASP.NET ViewState compromise.Recommendations
For Progress Telerik UI for ASP.NET AJAX versions prior to R2 2017 SP1, update to R2 2017 SP1 or later.
For Sitefinity versions prior to 10.0.6412.0, update to 10.0.6412.0 or later.
As a temporary workaround, consider restricting access to the
Telerik.Web.UI.DialogParametersEncryptionKey and MachineKey to minimize the risk of exploitation.Exploit
Correção
Insufficiently Protected Credentials
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Sitefinity
Telerik Ui For Asp.Net Ajax