Vulnerability · Published Mar 11, 2021 · Assigned by mitre

CVE-2021-28141

Critical 9.8

In plain English

A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)2.3%top 16.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. It allows unauthorized access to MicrosoftAjax.js through the Telerik.Web.UI.WebResource.axd file. This may allow the attacker to gain unauthorized access to the server and execute code. To exploit, one must use the parameter _TSM_HiddenField_ and inject a command at the end of the URI. NOTE: the vendor states that this is not a vulnerability. The request's output does not indicate that a "true" command was executed on the server, and the request's output does not leak any private source code or data from the server

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://pastebin.com/JULpfvFJ x_refsource_MISC
https://gist.github.com/shreyasfegade/e2480e26b2ed1d0c7175ecf7cb15f9c1 x_refsource_MISC