Skip to content
COOEY

EXPOSURES › CVE-2017-9248

CVE-2017-9248

HIGH ⌖ ON CISA KEV · EXPLOITED
DETAIL
SourceCISA-KEV · kev Published2021-11-03 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2017-9248 ↗
⌖ EXPLOITED IN THE WILD SHAME 65/100 exploited-in-wildunpatched

Progress Telerik UI for ASP.NET AJAX and Sitefinity suffered a cryptographic weakness allowing key disclosure, XSS, ViewState compromise, and file upload/download.

The cryptographic weakness in Telerik.Web.UI.dll exposed encryption keys and enabled XSS, ViewState compromise, and file operations. DIB orgs must ensure all third-party UI libraries are patched and monitored for KEV-listed vulnerabilities to prevent similar exposures.

Shame score — A known cryptographic weakness was actively exploited in the wild, enabling multiple attack vectors including XSS and file operations, indicating avoidable negligence in patching and supply-chain oversight.

▸ RECOMMENDED ACTION  Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED
progress · vendorASP.NET AJAX and Sitefinity · product
DESCRIPTION

Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files.

SENTIMENT · TRUSTED SOURCES
synthesis severe-fallout -0.60
Progress faced severe fallout due to a critical cryptographic weakness in its UI components, allowing key disclosure, XSS, and file manipulation, though the NVD entry itself is neutral in tone, the na
cooey ↗ severe-fallout +0.00
neutral
"Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files."
AFFECTED FEDRAMP PRODUCTS · 0
No correlated FedRAMP products.