Assessment
Why it matters
CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 75.1%; technical severity is CVSS 9.8.
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.
Who should care
- Teams operating ASP.NET AJAX and Sitefinity, Sitefinity, Ui For Asp.net Ajax
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether ASP.NET AJAX and Sitefinity, Sitefinity, Ui For Asp.net Ajax is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- Vendor advisory from www.telerik.com
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Treatment intelligence
Remediation intelligence
Vendor sources are listed before government and third-party guidance. Confirm product applicability and change prerequisites before deployment.
Verification noteAutomated link verification has not completed for this guidance yet.
Technical details
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-522
- Affected versions
- Progress ASP.NET AJAX and Sitefinity; Progress Sitefinity (End Excluding 10.0.6412.0); Telerik Ui For Asp.net Ajax (End Including 2017.2.503)
- Fixed versions
- Progress Sitefinity (Fixed from 10.0.6412.0)
- Published
- 3 July 2017
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
Signal timeline
- CVE published
- Added to CISA KEV
- Latest EPSS score: 75.1%
- Signal calculated at 82