CVE-2017-11317 Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or....
CriticalCVSS 9.8
EPSS 84.2%
CISA KEV
added 2022-04-11 · due 2022-05-02
Exploited in the wild
Framework module
Public exploit
PoC
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
CISA Known Exploited Vulnerability
- Date added
- 2022-04-11
- Due date (FCEB)
- 2022-05-02
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| telerik ui for asp.net ajax | <= 2016.3.1027 | No fix listed |
| telerik ui for asp.net ajax | = 2017.2.503 | No fix listed |
| telerik ui for asp.net ajax | = 2017.2.621 | No fix listed |
References
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- www.telerik.com mitigation vendor-advisory
- psirt.global.sonicwall.com third-party-advisory
- 43874 exploit third-party-advisory vdb-entry
- www.cisa.gov government-resource us-government-resource