# CVE-2017-9248

Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey, which makes it easier for remote attackers to defeat cryptographic protection mechanisms, leading to a MachineKey leak, arbitrary file uploads or downloads, XSS, or ASP.NET ViewState compromise.

- Page: https://www.vulneraibility.com/cve/CVE-2017-9248
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2021-11-03; CISA due date 2022-05-03
- EPSS: 75.10% (percentile 99.5)
- Public exploit code: 1 on Exploit-DB · 7 GitHub proofs of concept (first 2018-01-16)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2025-02-07)
- Weakness: CWE-522
- Published: 2017-07-03

## Affected

- progress:sitefinity
- telerik:ui_for_asp.net_ajax

## References

- [other] http://www.telerik.com/support/kb/aspnet-ajax/details/cryptographic-weakness
- [exploit] https://www.exploit-db.com/exploits/43873/
- [other] http://www.telerik.com/blogs/security-alert-for-telerik-ui-for-asp.net-ajax-and-progress-sitefinity
- [other] http://www.securityfocus.com/bid/99965
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-9248

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.