Lucene search

[email protected]NVD:CVE-2017-9248

HistoryJul 03, 2017 - 7:29 p.m.

CVE-2017-9248

2017-07-0319:29:00

CWE-522

[email protected]

web.nvd.nist.gov

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.25

Percentile

96.7%

JSON

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.

Affected configurations

Nvd

Node

progresssitefinityRange<10.0.6412.0

telerikui_for_asp.net_ajaxRange≤2017.2.503

VendorProductVersionCPE
progresssitefinity*cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*
telerikui_for_asp.net_ajax*cpe:2.3:a:telerik:ui_for_asp.net_ajax:*:*:*:*:*:*:*:*