CRITICAL🇵🇱 Wersja polska

CVE-2021-28141

CVSS 9.8v3.1pub. 2021-03-11upd. 2025-06-30

An issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. It allows unauthorized access to MicrosoftAjax.js through the Telerik.Web.UI.WebResource.axd file. This may allow the attacker to gain unauthorized access to the server and execute code. To exploit, one must use the parameter _TSM_HiddenField_ and inject a command at the end of the URI. NOTE: the vendor states that this is not a vulnerability. The request's output does not indicate that a "true" command was executed on the server, and the request's output does not leak any private source code or data from the server

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Progress Telerik Ui For Asp.net Ajax

    APP
    Progress
    2021.1.224
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2017-11357CRITICAL9.8⚠ KEVPL ✓same product

RCE w Progress Telerik UI for ASP.NET AJAX — nieograniczony upload plików

CVE-2019-19790CRITICAL9.8PL ✓same product

Path Traversal w RadChart (Telerik UI for ASP.NET AJAX) — odczyt i usuwanie plików graficznych

CVE-2026-13182HIGH7.5PL ✓same product

Padding oracle w RadAsyncUpload – ujawnienie metadanych w Telerik UI for AJAX

CVE-2026-13181HIGH8.1PL ✓same product

RCE w Progress Telerik UI for AJAX — fałszywe metadane uploadu

CVE-2026-13183HIGH7.5PL ✓same product

Timing oracle w RadAsyncUpload (Telerik UI for AJAX) — wyciek metadanych