CVE-2017-9140

EPSS 9.6%

Vexday Risk Score

18Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 9.6%KEV nãoPoC —Nuclei simMetasploit —Patch —

Lifecycle

22 May 2017Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Cross-site scripting (XSS) vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 (11.0.17.406) allows remote attackers to inject arbitrary web script or HTML via the bgColor parameter to Telerik.ReportViewer.axd.

Affected products

n/a · n/a

References

https://knowledgebase.progress.com/articles/Article/Security-Advisory-for-Resolving-Security-vulnerabilities-September-2018 https://www.veracode.com/blog/research/anatomy-cross-site-scripting-flaw-telerik-reporting-module http://www.telerik.com/support/whats-new/reporting/release-history/telerik-reporting-r1-2017-sp2-%28version-11-0-17-406%29