This vulnerability (CWE-345) affects Telerik UI for ASP.NET AJAX versions up to and including 2011.2.712. The DialogHandler component does not sufficiently verify the authenticity of request parameters, allowing an attacker to tamper with these parameters. Such tampering can alter the server-side behavior of dialogs, potentially enabling further chained exploits. The CVSS 3.1 base score is 5.9 (medium), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

The vulnerability allows an attacker to modify server-side dialog behavior by tampering with request parameters, impacting the integrity of the application. There is no direct impact on confidentiality or availability. The flaw could be leveraged as part of a chained attack but does not itself disclose sensitive information or cause denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is published, users should monitor Progress Software advisories for updates. Until a fix is available, consider restricting access to the affected DialogHandler endpoints or implementing additional request validation controls to mitigate tampering risks.