Telerik.Web.UI.dll 2009 version

[Chit Way]

Hi,

Wound like to check whether Telerik.Web.UI.dll 2009 version is affected by CVE-2019-18935 or CVE-2017-11317?

Our application is using Telerik.Web.UI.dll 2009 version and please let us know if any vulnerabilities with this version?

Please advise.

[Vessy]

Hi Chit,

Your app will be safe from the known vulnerabilities if you are using a Telerik.Web.UI.dll assembly released before Q1 2010 (version 2010.1.309) or after R3 2019 SP1 (2019.3.1023):

https://docs.telerik.com/devtools/aspnet-ajax/controls/asyncupload/security

For more information on this matter, please refer to the Allows JavaScriptSerializer Deserialization (CVE-2019-18935) article:

https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization

Regards,
Vessy
Progress Telerik