PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-9248 Progress CVE debrief

CVE-2017-9248 is a cryptographic weakness affecting Progress Telerik UI for ASP.NET AJAX and Sitefinity. CISA lists it in the Known Exploited Vulnerabilities catalog, which means it has been observed in active exploitation and should be treated as a priority remediation item. The source corpus directs organizations to apply updates per vendor instructions.

Vendor
Progress
Product
ASP.NET AJAX and Sitefinity
CVSS
CRITICAL 9.8
CISA KEV
Listed
Original CVE published
2021-11-03
Original CVE updated
2021-11-03
Advisory published
2021-11-03
Advisory updated
2021-11-03

Who should care

Administrators, application owners, and security teams responsible for Progress Telerik UI for ASP.NET AJAX and Sitefinity deployments, especially where the software is exposed to untrusted networks.

Technical summary

The available official metadata identifies a cryptographic weakness in Progress Telerik UI for ASP.NET AJAX and Sitefinity. The corpus does not provide deeper technical mechanics or CVSS scoring, but CISA has designated the issue as known exploited and references vendor-directed updates as the required action.

Defensive priority

High — CISA KEV-listed and marked as known exploited.

Recommended defensive actions

  • Inventory all deployments of Progress Telerik UI for ASP.NET AJAX and Sitefinity.
  • Apply updates per vendor instructions as directed in the CISA KEV entry.
  • Prioritize remediation of any internet-facing or externally reachable instances.
  • Validate that patched versions are in place and remove or isolate unsupported instances.

Evidence notes

Official evidence in the supplied corpus comes from the CISA Known Exploited Vulnerabilities catalog entry for CVE-2017-9248, which states the affected vendor/product as Progress ASP.NET AJAX and Sitefinity, notes known exploitation status, and directs applying updates per vendor instructions. The official CVE and NVD links are included for record lookup, but the corpus does not supply additional technical detail or a CVSS score.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-9248 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-9248

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-9248 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-9248

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.