CVE-2024-7575
published 2024-09-25CVE-2024-7575: In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink…
PriorityP181critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
0.69%
47.9th percentile
In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink elements.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| progress_software | telerik_ui_for_wpf | >= 2011.3.1116 < 2024.3.924 | 2024.3.924 |
| telerik | ui_for_wpf | < 2024.3.924 | 2024.3.924 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jp9w-w77g-78h3: In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024
ghsa_unreviewed·2024-09-25
CVE-2024-7575 [HIGH] CWE-77 GHSA-jp9w-w77g-78h3: In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024
In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink elements.
VulnCheck
Progress ui_for_wpf Improper Neutralization of Special Elements used in a Command ('Command Injection')
vulncheck·2024·CVSS 7.8
CVE-2024-7575 [HIGH] Progress ui_for_wpf Improper Neutralization of Special Elements used in a Command ('Command Injection')
Progress ui_for_wpf Improper Neutralization of Special Elements used in a Command ('Command Injection')
In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink elements.
Affected: Progress ui_for_wpf
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://cyble.com/blog/cyble-honeypot-sensors-detect-d-link-cisco-qnap-and-linux-attacks/
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-09-25
Published
Exploited in the wild