CVE-2017-9140

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-05-22 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 (11.0.17.406) allows remote attackers to inject arbitrary web script or HTML via the bgColor parameter to Telerik.ReportViewer.axd.

Affected products

Progress Sitefinity Cms: from 4.2 through 11.0
Progress Software Telerik Reporting: before 11.0.17.406 — fixed in 11.0.17.406

How to fix

Upgrade to a fixed version: Progress Software Telerik Reporting 11.0.17.406. Check the vendor advisory for mitigations.

References

http://www.telerik.com/support/whats-new/reporting/release-history/telerik-reporting-r1-2017-sp2-%28version-11-0-17-406%29
https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-September-2018
https://www.veracode.com/blog/research/anatomy-cross-site-scripting-flaw-telerik-reporting-module
http://www.telerik.com/support/whats-new/reporting/release-history/telerik-reporting-r1-2017-sp2-%28version-11-0-17-406%29
https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-September-2018
https://www.veracode.com/blog/research/anatomy-cross-site-scripting-flaw-telerik-reporting-module

Get alerted when CVE-2017-9140 or the next vulnerability affects your stack