CVE-2017-9248

Telerik.Web.UI.dll Progressda ASP.NET AJAX uchun Telerik UI R2 2017 SP1 va Sitefinity 10.0.6412.0 dan oldingi versiyalari Telerik.Web.UI.DialogParametersEncryptionKey yoki MachineKey ni to‘g‘ri himoya qilmaydi, bu esa masofaviy tajovuzkorlarga MachineeyKbit kriptografik, kriptografik mexanizmlarni mag‘lub etishni osonlashtiradi. fayllarni yuklash yoki yuklab olish, XSS yoki ASP.NET ViewState kelishuvi.

CVSS Vector

Manbalar

• http://www.securityfocus.com/bid/99965
• http://www.telerik.com/blogs/security-alert-for-telerik-ui-for-asp.net-ajax-and-progress-sitefinity
• http://www.telerik.com/support/kb/aspnet-ajax/details/cryptographic-weakness
• https://www.exploit-db.com/exploits/43873/
• http://www.securityfocus.com/bid/99965