Name: CVE-2019-18935: Deserialization of Untrusted Data
Creator: Rapid7
Published: 2019-12-11T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2019-18935, CWE-502, Exploited in the Wild, CISA KEV Exploit, Rapid7 Critical, Metasploit Module, Used with Ransomware, CVSS 9.8, EPSS 0.93657, CISA KEV

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)

CVSS Details

CVSS 3.1 Base Score: 9.8
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Telerik_ui_for_asp.net_ajax	—	Upgrade Telerik UI for ASP.NET AJAX to the latest version	Feb 10, 2020	Dec 11, 2019

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence