CVE-2021-28141
highpriority · track · 40OT risk · elevatedEPSS 0.023 · 83 %ileEUUSEPSS · scored 2026-10-27
An issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. It allows unauthorized access to MicrosoftAjax.js through the Telerik.Web.UI.WebResource.axd file. This may allow the attacker to gain unauthorized access to the server and execute code. To exploit, one must use the parameter _TSM_HiddenField_ and inject a command at the end of the URI. NOTE: the vendor states that this is not a vulnerability. The request's output does not indicate that a "true" command was executed on the server, and the request's output does not leak any private source code or data from the server
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
- progress telerik ui for asp.net ajax= 2021.1.224nvdUScpe:2.3:a:progress:telerik_ui_for_asp.net_ajax:*:*:*:*:*:*:*:*
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://gist.github.com/shreyasfegade/e2480e26b2ed1d0c7175ecf7cb15f9c1cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-28141cnnvd
- https://pastebin.com/JULpfvFJcnnvd
- https://gist.github.com/shreyasfegade/e2480e26b2ed1d0c7175ecf7cb15f9c1enisa_euvd
- https://pastebin.com/JULpfvFJenisa_euvd
- https://gist.github.com/shreyasfegade/e2480e26b2ed1d0c7175ecf7cb15f9c1ExploitThird Party Advisorynvd
- https://pastebin.com/JULpfvFJExploitThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan