PT-2019-15960 · Telerik · Telerik Ui For Asp.Net Ajax

Movrment · Publicado 2019-12-13 · Atualizado 2025-06-30 · CVE-2019-19790

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Telerik UI for ASP.NET AJAX versions (all versions of RadChart)

Description The issue allows a remote attacker to read and delete specific image files on the server through a specially crafted request, exploiting path traversal in RadChart. The affected image extensions include .BMP, .EXIF, .GIF, .ICON, .JPEG, .PNG, .TIFF, and .WMF.

Recommendations To resolve the issue, remove RadChart's HTTP handler from the web.config file, specifically the type Telerik.Web.UI.ChartHttpHandler.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-19790

Produtos afetados

Telerik Ui For Asp.Net Ajax

Referências · 5

• https://docs.telerik.com/devtools/aspnet-ajax/controls/chart/overview · Aviso do Fabricante
• https://t.me/cvenotify/127087 · Publicação no Telegram
• https://telerik.com/forums/-620f6977edef · Aviso do Fabricante
• https://telerik.com/forums/path-traversal-vulnerability-in-radchart-image-handler · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-19790 · Nota de Segurança