CVE-2019-19790: Path Traversal
Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with extension .BMP, .EXIF, .GIF, .ICON, .JPEG, .PNG, .TIFF, or .WMF on the server through a specially crafted request. NOTE: RadChart was discontinued in 2014 in favor of RadHtmlChart. All RadChart versions were affected. To avoid this vulnerability, you must remove RadChart's HTTP handler from a web.config (its type is Telerik.Web.UI.ChartHttpHandler).
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-19790?
CVE-2019-19790 is a path traversal vulnerability in Telerik UI for ASP.NET AJAX that allows a remote attacker to read and delete certain image files on the server.
How severe is CVE-2019-19790?
CVE-2019-19790 has a severity rating of 9.8, which is considered critical.
Which software is affected by CVE-2019-19790?
The vulnerability affects Telerik RadChart and Telerik UI for ASP.NET AJAX.
How can an attacker exploit CVE-2019-19790?
An attacker can exploit CVE-2019-19790 by sending a specially crafted request to the server, which allows them to read and delete specific image files.
Is there a fix available for CVE-2019-19790?
Yes, Telerik discontinued RadChart in 2014 and recommended using RadHtmlChart instead, which is not vulnerable to CVE-2019-19790.