HackerFeeds
All CVEs

CVE-2019-18935

CRITICAL9.8
CISA KEV

Published 2019-12-11 · Updated 2026-06-17 · Source cve@mitre.org

Summary

CVE-2019-18935 is a critical-severity (CVSS 9.8) vulnerability in Progress Telerik UI for ASP.NET AJAX. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2021, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by May 3, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Progress has 9 vulnerabilities in the KEV catalog, 4 of them linked to ransomware.

All 9 known-exploited Progress vulnerabilities →

Description

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-502CWE-502

CISA Known-Exploited Vulnerability

Product: Progress — Telerik UI for ASP.NET AJAX

Name: Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability

Date added: 2021-11-03 · Due: 2022-05-03

USED IN RANSOMWARE

Required action: Apply updates per vendor instructions.

References

View on NVD