CVE-2017-9248
- State
- Published
- Severity
- 9.8 Critical
- Published
- Jul 3, 2017
- Updated
- Oct 21, 2025
- Reserved
- May 28, 2017
Description
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-522 Insufficiently Protected Credentials
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- http://www.telerik.com/support/kb/aspnet-ajax/details/cryptographic-weakness
- 43873exploit
- http://www.telerik.com/blogs/security-alert-for-telerik-ui-for-asp.net-ajax-and-progress-sitefinity
- 99965vdb-entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9248government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.