CVE-2017-9140: XSS
Published May 22, 2017
·Updated
Cross-site scripting (XSS) vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 (11.0.17.406) allows remote attackers to inject arbitrary web script or HTML via the bgColor parameter to Telerik.ReportViewer.axd.
Affected Software
2 affected components
Progress Telerik Reporting<11.0.17.406
Progress Sitefinity CMS>=4.2<=11.0
Event History
May 22, 2017
CVE Published
via MITRE·04:54 AM
Data Sourced
via MITRE·04:54 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-9140?
The severity of CVE-2017-9140 is classified as medium due to the potential for XSS attacks.
2
How do I fix CVE-2017-9140?
To fix CVE-2017-9140, upgrade Telerik Reporting to version 11.0.17.406 or later.
3
What type of vulnerability is CVE-2017-9140?
CVE-2017-9140 is a cross-site scripting (XSS) vulnerability.
4
Which software is affected by CVE-2017-9140?
CVE-2017-9140 affects Telerik Reporting for ASP.NET WebForms and Sitefinity CMS versions prior to the specified patches.
5
Can CVE-2017-9140 be exploited remotely?
Yes, CVE-2017-9140 can be exploited remotely by injecting arbitrary web scripts or HTML.