PT-2017-4156 · Progress · Telerik Ui For Asp.Net Ajax+1
Paul Taylor
·
Published
2017-07-03
·
Updated
2025-03-14
·
CVE-2017-9248
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Progress Telerik UI for ASP.NET AJAX versions prior to R2 2017 SP1
Sitefinity versions prior to 10.0.6412.0
Description
The issue is related to insufficient protection of registration data in the Telerik.Web.UI.dll library, which is part of the Telerik UI for ASP.NET AJAX and Sitefinity content management system. This weakness can be exploited by a remote attacker to reveal encryption keys, specifically
Telerik.Web.UI.DialogParametersEncryptionKey and/or MachineKey. This can lead to a MachineKey leak, arbitrary file uploads or downloads, cross-site scripting (XSS), or ASP.NET ViewState compromise.Recommendations
For Progress Telerik UI for ASP.NET AJAX versions prior to R2 2017 SP1, update to R2 2017 SP1 or later.
For Sitefinity versions prior to 10.0.6412.0, update to 10.0.6412.0 or later.
As a temporary workaround, consider restricting access to the
Telerik.Web.UI.DialogParametersEncryptionKey and MachineKey to minimize the risk of exploitation.Exploit
Fix
Insufficiently Protected Credentials
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Sitefinity
Telerik Ui For Asp.Net Ajax