Vulnerabilities Reported in Telerik UI for WPF used by Javelin

Products

• CA Test Data Manager (Data Finder / Grid Tools)

Issue/Introduction

Vulnerability scanners may report high or critical vulnerabilities associated with Telerik.Windows.Controls.dll within the Javelin installation path.

• Path: C:\Program Files\Grid-Tools\Javelin\Telerik.Windows.Controls.dll
• Identified CVEs: CVE-2024-7575, CVE-2024-7576, CVE-2024-8316, CVE-2024-10012.

Environment

All supported Javelin releases.

Cause

These vulnerabilities reside in the 3rd-party Telerik UI for WPF component used by the Javelin UI.
NOTE: The TDM Portal uses the JaaaavelinExecutor.exe (command line executable), which is not impacted.

TDM Engineering has analyzed the risk for each CVE based on Javelin's specific implementation:

• CVE-2024-7575 (Command Injection), CVE-2024-7576 (Unsafe Deserialization), and CVE-2024-10012 (Unsafe Deserialization):
  • Status: Not exploitable in Javelin.
  • Details: These vulnerabilities specifically affect the RichTextBox, PdfViewer, and Spreadsheet controls. While the vulnerable assemblies exist on disk, these specific controls are never instantiated or used within the Javelin application. Per Telerik's security advisory, applications that do not use these controls are not affected.
• CVE-2024-8316 (Unsafe Deserialization):
  • Status: Valid.
  • Details: Telerik UI for WPF (specifically targeting applications utilizing the RadDiagram control). 

Resolution

1. CVE-2024-7575, CVE-2024-7576, CVE-2024-10012: No action is required as these are considered "false positives" due to the controls not being in use.
2. CVE-2024-8316: This vulnerability is resolved in patch Javelin-5.0.0.110.zip, which mitigates the issue by removing the affected component.
3. General Mitigation: If your security policy requires remediation of all flagged files, ensure that access to the Javelin installation directory is restricted to authorized administrative users only.