CVE-2017-11357

· CRITICALAnalyzed

← All CVEs

CVSS v3.1

9.8

EPSS

75.71%

Published

Aug 23, 2017

Modified

Apr 22, 2026

CISA Known Exploited Vulnerability

Added: 2023-01-26 · Due: 2023-02-16

Apply updates per vendor instructions.

Public PoC / Exploit (2)

All weaponized →

Exploit-DBTelerik UI for ASP.NET AJAX 2012.3.1308 < 2017.1.118 - Arbitrary File Upload TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-434CWE-434

Affected Products (1)

progress · telerik_ui_for_asp.net_ajax (up to 2020.1.114)vulnerable

References (5)

http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference

MitigationVendor Advisory

https://www.exploit-db.com/exploits/43874/

ExploitThird Party AdvisoryVDB Entry

http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference

MitigationVendor Advisory

https://www.exploit-db.com/exploits/43874/

ExploitThird Party AdvisoryVDB Entry

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11357

US Government Resource

KEV Catalog EPSS Scores Vendors All CVEs