Description

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.

Remediation

References

CVE-2017-9248

Related Vulnerabilities

WordPress Plugin WP Upload Restriction Multiple Vulnerabilities (2.2.3)

WordPress Plugin WP-Members Membership Cross-Site Scripting (3.4.9.2)

MediaWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2021-45038)

Ruby Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2019-16254)

WordPress Plugin BuddyPress Information Disclosure (5.1.1)

Severity

Critical

Classification

CVE-2017-9248 CWE-522 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities