Outbreak Alert: Telerik UI Attack

[Bhumit_Mali]

FortiRecon provides outside-in coverage for risks towards customers.     External Attack Surface Management helps customers to identify exposure to known and unknown enterprise assets and associated vulnerabilities across the enterprise.     Vulnerability Intelligence Module under Adversary Centric Intelligence (ACI) provides realistic view of impact of the vulnerability based upon chatter and discussion of the same across various external sources such as Darkweb, social media, News / Blogs etc.
CVE ID	CVE-2017-11357
CVE Title	Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability
CVE Severity	High
ACI Reporting Coverage	4 Reports (OSINT)
Additional References	·       1 Darknet mention referencing the vulnerability. ·       1 article referencing possibly working exploit(s) for this vulnerability.  ·       1 public code repository containing possible POC exploits for this vulnerability.  ·       17 mentions on social media for this vulnerability.
EASM Scanner	No

CVE ID	CVE-2017-11317
CVE Title	Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability
CVE Severity	High
ACI Reporting Coverage	5 Reports (OSINT)
Additional References	·       1 Darknet mentions referencing this vulnerability. ·       2 articles referencing possibly working exploit(s) for this vulnerability.  ·       1 article referencing this CVE on the security blog.  ·       3 public code repositories containing possible POC exploits for this vulnerability.  ·       19 mentions on social media for this vulnerability.
EASM Scanner	No

CVE ID	CVE-2019-18935
CVE Title	Progress Telerik UI for ASP.NET deserialization bug
CVE Severity	High
ACI Reporting Coverage	14 Reports (OSINT)
Additional References	·       4 Darknet mentions referencing this vulnerability. ·       3 articles referencing possibly working exploit(s) for this vulnerability.  ·       1 article referencing this CVE on security blog. ·       11 public code repositories containing possible POC exploits for this vulnerability.  ·       132 mentions on social media for this vulnerability.
EASM Scanner	No