CVE-2017-9248

9.8 criticalKEVEPSS 75%

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 75% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2021-11-03, due 2022-05-03
CWE: CWE-522
Published: 2017-07-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

progress:sitefinity
telerik:ui_for_asp.net_ajax

References

http://www.securityfocus.com/bid/99965
http://www.telerik.com/blogs/security-alert-for-telerik-ui-for-asp.net-ajax-and-progress-sitefinity
http://www.telerik.com/support/kb/aspnet-ajax/details/cryptographic-weakness
https://www.exploit-db.com/exploits/43873/
http://www.securityfocus.com/bid/99965

Check your stack JSON