exploitDog

CVE-2026-13184

Опубликовано: 22 июл. 2026

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock further exploit chains.

Ссылки

https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rau-unauth-deserialization-chain-cve-2026-13184
Vendor Advisory
Mitigation

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:progress:telerik_ui_for_asp.net_ajax:*:*:*:*:*:*:*:*

Версия от 2010.1309 (включая) до 2026.2.708 (исключая)

EPSS

Процентиль: 10%

0.00202

Низкий

7.5 High

CVSS3

Дефекты

CWE-321

Связанные уязвимости

GHSA-xj5r-8wvg-3cxf

CVSS3: 7.5

github

24 дня назад

In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock further exploit chains.

EPSS

Процентиль: 10%

0.00202

Низкий

7.5 High

CVSS3

Дефекты

CWE-321