CVE-2017-9248 is a critical vulnerability affecting Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0, stemming from insufficient protection of encryption keys. With a CVSS score of 9.8 (CRITICAL), this easily exploitable flaw allows remote attackers to compromise cryptographic mechanisms, leading to severe impacts including MachineKey leaks, arbitrary file operations, XSS, and ViewState compromise. This vulnerability is actively exploited in the wild, as indicated by its presence in the KEV catalog and high EPSS score, with public exploit code available and significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 10.0.6412.0CPE matchmatch criteria | cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:* | ||
<= 2017.2.503CPE matchmatch criteria | cpe:2.3:a:telerik:ui_for_asp.net_ajax:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.