CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2017-11357
Critical (9.8) in Telerik User Interface (UI) for ASP.NET AJAX. In CISA KEV since 2023-01-26, with known ransomware use. EPSS 78% chance of exploitation in the next 30 days.
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
Severity
- EPSS
- 78% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2023-01-26, due 2023-02-16, known ransomware use
- CWE
- CWE-434
- Published
- Modified
- Record from
- the NVD, synced
Affected
- progress:telerik_ui_for_asp.net_ajax
References
- http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference
- https://www.exploit-db.com/exploits/43874/
- http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference
- https://www.exploit-db.com/exploits/43874/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11357