CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2019-18935

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)

Exploit prediction scoring system (EPSS) score

EPSS Score 0.937

EPSS Ranking 99.8%

CVSS Severity

CVSS v3 Score 9.8

CVSS v2 Score 7.5

Proposed Action

Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process.

Ransomware Campaign

Known

References

Products affected by CVE-2019-18935

Telerik » Ui For Asp.net Ajax » Version: 2011.1.315

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2011.1.315
Telerik » Ui For Asp.net Ajax » Version: 2011.1315

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2011.1315
Telerik » Ui For Asp.net Ajax » Version: 2011.1413

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2011.1413
Telerik » Ui For Asp.net Ajax » Version: 2011.1519

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2011.1519
Telerik » Ui For Asp.net Ajax » Version: 2011.2712

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2011.2712
Telerik » Ui For Asp.net Ajax » Version: 2011.2915

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2011.2915
Telerik » Ui For Asp.net Ajax » Version: 2011.3.1305

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2011.3.1305
Telerik » Ui For Asp.net Ajax » Version: 2011.31115

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2011.31115
Telerik » Ui For Asp.net Ajax » Version: 2012.1.215

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2012.1.215
Telerik » Ui For Asp.net Ajax » Version: 2012.1.411

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2012.1.411
Telerik » Ui For Asp.net Ajax » Version: 2012.2.607

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2012.2.607
Telerik » Ui For Asp.net Ajax » Version: 2012.2.724

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2012.2.724
Telerik » Ui For Asp.net Ajax » Version: 2012.2.912

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2012.2.912
Telerik » Ui For Asp.net Ajax » Version: 2012.3.1016

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2012.3.1016
Telerik » Ui For Asp.net Ajax » Version: 2012.3.1205

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2012.3.1205
Telerik » Ui For Asp.net Ajax » Version: 2012.3.1308

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2012.3.1308
Telerik » Ui For Asp.net Ajax » Version: 2013.1.220

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2013.1.220
Telerik » Ui For Asp.net Ajax » Version: 2013.1.403

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2013.1.403
Telerik » Ui For Asp.net Ajax » Version: 2013.1.417

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2013.1.417
Telerik » Ui For Asp.net Ajax » Version: 2013.2.611

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2013.2.611
Telerik » Ui For Asp.net Ajax » Version: 2013.2.717

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2013.2.717
Telerik » Ui For Asp.net Ajax » Version: 2013.3.1015

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2013.3.1015
Telerik » Ui For Asp.net Ajax » Version: 2013.3.1114

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2013.3.1114
Telerik » Ui For Asp.net Ajax » Version: 2013.3.1324

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2013.3.1324
Telerik » Ui For Asp.net Ajax » Version: 2014.1.225

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2014.1.225
Telerik » Ui For Asp.net Ajax » Version: 2014.1.403

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2014.1.403
Telerik » Ui For Asp.net Ajax » Version: 2014.2.618

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2014.2.618
Telerik » Ui For Asp.net Ajax » Version: 2014.2.724

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2014.2.724
Telerik » Ui For Asp.net Ajax » Version: 2014.3.1024

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2014.3.1024
Telerik » Ui For Asp.net Ajax » Version: 2014.3.1209

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2014.3.1209
Telerik » Ui For Asp.net Ajax » Version: 2015.1.204

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2015.1.204
Telerik » Ui For Asp.net Ajax » Version: 2015.1.225

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2015.1.225
Telerik » Ui For Asp.net Ajax » Version: 2015.2.604

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2015.2.604
Telerik » Ui For Asp.net Ajax » Version: 2015.2.623

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2015.2.623
Telerik » Ui For Asp.net Ajax » Version: 2015.2.729

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2015.2.729
Telerik » Ui For Asp.net Ajax » Version: 2015.2.826

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2015.2.826
Telerik » Ui For Asp.net Ajax » Version: 2015.3.1111

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2015.3.1111
Telerik » Ui For Asp.net Ajax » Version: 2015.3.930

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2015.3.930
Telerik » Ui For Asp.net Ajax » Version: 2016.1.113

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2016.1.113
Telerik » Ui For Asp.net Ajax » Version: 2016.1.225

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2016.1.225
Telerik » Ui For Asp.net Ajax » Version: 2016.2.504

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2016.2.504
Telerik » Ui For Asp.net Ajax » Version: 2016.2.607

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2016.2.607
Telerik » Ui For Asp.net Ajax » Version: 2016.3.1018

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2016.3.1018
Telerik » Ui For Asp.net Ajax » Version: 2016.3.1027

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2016.3.1027
Telerik » Ui For Asp.net Ajax » Version: 2016.3.914

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2016.3.914
Telerik » Ui For Asp.net Ajax » Version: 2017.1.118

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2017.1.118
Telerik » Ui For Asp.net Ajax » Version: 2017.1.228

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2017.1.228
Telerik » Ui For Asp.net Ajax » Version: 2017.2.503

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2017.2.503
Telerik » Ui For Asp.net Ajax » Version: 2017.2.621

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2017.2.621
Telerik » Ui For Asp.net Ajax » Version: 2017.2.711

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2017.2.711
Telerik » Ui For Asp.net Ajax » Version: 2017.3.913

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2017.3.913
Telerik » Ui For Asp.net Ajax » Version: 2018.1.117

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2018.1.117
Telerik » Ui For Asp.net Ajax » Version: 2018.2.516

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2018.2.516
Telerik » Ui For Asp.net Ajax » Version: 2018.2.710

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2018.2.710
Telerik » Ui For Asp.net Ajax » Version: 2018.3.910

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2018.3.910
Telerik » Ui For Asp.net Ajax » Version: 2019.1.115

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2019.1.115
Telerik » Ui For Asp.net Ajax » Version: 2019.1.215

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2019.1.215
Telerik » Ui For Asp.net Ajax » Version: 2019.2.514

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2019.2.514
Telerik » Ui For Asp.net Ajax » Version: 2019.3.1023

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2019.3.1023
Telerik » Ui For Asp.net Ajax » Version: 2019.3.917

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2019.3.917
Telerik » Ui For Asp.net Ajax » Version: 2020.1.114

cpe:2.3:a:telerik:ui_for_asp.net_ajax:2020.1.114

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2019-18935

Products

Pricing

Contact Us