CVE-2017-11357

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - cve@mitre.org

Published

2017-08-23

Last modified

2026-08-14

Known exploited (CISA KEV)

since 2023-01-26, action due 2023-02-16: Apply updates per vendor instructions.

Weaknesses

CWE-434

Affected products

• Telerik Ui For Asp.net Ajax (Progress)

References

• http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference
• https://www.exploit-db.com/exploits/43874/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11357