CVE-2019-18935

KEV · Ransomware

Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability

Vendor / Project: Progress
Product: Telerik UI for ASP.NET AJAX
Date added: Nov 3, 2021
Due date: May 3, 2022
Known ransomware use: Known
CWEs: CWE-502

Description

Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2019-18935