PT-2024-38430 · Telerik · Telerik Ui For Wpf

Published 2024-09-25 · Updated 2024-10-03 · CVE-2024-7576

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924)

Description A code execution attack is possible through an insecure deserialization vulnerability, allowing for potential code execution risks.

Recommendations For versions prior to 2024 Q3 (2024.3.924), update to version 2024 Q3 (2024.3.924) or later to resolve the issue. As a temporary workaround, consider restricting deserialization operations to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-7576

Affected Products

Telerik Ui For Wpf

References · 8

• https://osv.dev/vulnerability/CVE-2024-7576 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7576 · Security Note
• https://docs.telerik.com/devtools/wpf/knowledge-base/unsafe-deserialization-cve-2024-7576 · Vendor Advisory
• https://t.me/latest_high_impact_cve/1215 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1838995150367855094 · Twitter Post
• https://t.me/cvedetector/6319 · Telegram Post
• https://t.me/cvenotify/96924 · Telegram Post
• https://twitter.com/CVEnew/status/1838945665906250234 · Twitter Post