SecurityThe Hacker Newsabout 3 hours ago
Telerik UI Bug Chains to Unauthenticated RCE
1 min read
A TantoSec proof-of-concept chains an AES-CBC padding oracle in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution, but only against apps in a specific non-default configuration. Progress patched the chain in July. No confirmed in-the-wild exploitation exists.
Level
Hype check
Tap to vote and see what everyone thinks.
In this storyOracle
Summary by ByteBrief
