CVE-2017-9140

Cross-site scripting (XSS) means an attacker tries to smuggle a small piece of code into a page by using a website input parameter. In this case, the report viewer can take a color-related setting (bgColor) and—if it’s not handled safely—could end up running attacker-provided script in a visitor’s browser. The impact is that attackers can potentially trick users, steal sessions, or alter what users see on the page.

This matters if your business runs a website using Telerik Reporting for ASP.NET WebForms Report Viewer (the Telerik ReportViewer control), especially if users can load report viewer pages that take URL parameters like bgColor. Reachability matters: it’s only a risk if an attacker can reach the report viewer endpoint (Telerik.ReportViewer.axd) and get a victim to open the crafted link (or otherwise trigger the page load).

This should be treated as a medium-priority fix because it’s a direct website security flaw (XSS) and it can affect real visitors when the crafted page is opened. However, there’s no indication in the provided findings that it’s confirmed as actively exploited in the wild, so this is not an emergency for everyone—still, update if you’re running an affected Telerik Reporting version.

Confirm whether you’re affected

• Identify whether your application uses Telerik Reporting for ASP.NET WebForms Report Viewer.
• Check the installed Telerik Reporting version. If it is earlier than R1 2017 SP2 (11.0.17.406), you are in the affected range per the provided findings.
• Locate where Telerik ReportViewer is hosted (commonly the Telerik.ReportViewer.axd endpoint) and confirm it is reachable from the internet (or from untrusted networks).

Upgrade to the fixed version

• Upgrade Telerik Reporting to 11.0.17.406 (this is the fixed version named in the findings).
• After upgrading, verify that report viewer pages render correctly and that URL parameters such as bgColor are no longer able to inject or execute script.

Testing guidance (practical)

• Pick a non-production environment or maintenance window.
• Load a report viewer URL that includes the bgColor parameter and confirm the resulting page does not reflect unsafe content in a way that executes.
• Specifically check that the browser shows no unexpected script execution and that the page output is properly treated as data (not code).

If you can’t upgrade right away

• Limit who can access the report viewer endpoint (network-level restrictions, authentication in front of report pages, and reducing exposure of Telerik.ReportViewer.axd).
• Treat this as temporary while you schedule the Telerik Reporting upgrade to 11.0.17.406.

What to monitor

• Watch for unusual requests to the report viewer endpoint with odd query-string values.
• Monitor for unexpected front-end behavior on report pages (unexpected popups, altered content, or console errors) after changes.

CISA KEV

• Not listed in CISA KEV per the provided findings.

Severity is reported as medium (CVSS 6.1), and the weakness is CWE-79 (cross-site scripting). The vulnerability is specifically in Telerik.ReportViewer.WebForms.dll within Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 (11.0.17.406). Attack vector/mechanism: remote attacker injects script/HTML via the bgColor parameter to Telerik.ReportViewer.axd; impact occurs when a victim loads the crafted page and the injected script runs in their browser context. No KEV entry is provided, and no confirmed exploitation details are included in the findings. Exploit maturity/availability in the provided sources is limited to a detection template only (no weaponized, confirmed in-the-wild detail). EPSS is provided as a prediction (9.7% with a flat trend) but does not override the fix guidance. Patch state: fixed version is 11.0.17.406 for telerik reporting; sitefinity cms is listed among affected products but no additional fix details are provided beyond the Telerik Reporting fixed version.