VULNERABILITY INTELLIGENCE

CVE-2017-11357

CVSS score9.8 CRITICAL

EPSS probability77.68%

CISA KEVKnown exploited vulnerability

Published2017-08-23

Last modified2026-08-14

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability

Vendor / product: Telerik / User Interface (UI) for ASP.NET AJAX

Description

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

Weakness classification

CWE-434: Unrestricted Upload of File with Dangerous Type

Primary references

cve@mitre.org — Mitigation, Vendor Advisory
cve@mitre.org — Exploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource