What’s Vulnerable › Vulnerabilities

CVE-2017-9248: Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2021-11-03
• EPSS: 75.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-07-03 · updated 2026-06-17
• Weakness: CWE-522

Description

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.

Affected products

• Progress Software Corporation Sitefinity: before 10.0.6412.0 — fixed in 10.0.6412.0
• Telerik Ui For Asp.Net Ajax: through 2017.2.503

How to fix

Upgrade to a fixed version: Progress Software Corporation Sitefinity 10.0.6412.0. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/99965
• http://www.telerik.com/blogs/security-alert-for-telerik-ui-for-asp.net-ajax-and-progress-sitefinity
• http://www.telerik.com/support/kb/aspnet-ajax/details/cryptographic-weakness
• https://www.exploit-db.com/exploits/43873/
• http://www.securityfocus.com/bid/99965
• http://www.telerik.com/blogs/security-alert-for-telerik-ui-for-asp.net-ajax-and-progress-sitefinity
• http://www.telerik.com/support/kb/aspnet-ajax/details/cryptographic-weakness
• https://www.exploit-db.com/exploits/43873/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9248

Get alerted when CVE-2017-9248 or the next vulnerability affects your stack