CVE-2017-11317criticalunder attackCWE-326

CVE-2017-11317

Published · Updated

Follow this CVE+ Monitor User Interface for ASP.NET AJAX

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 84%
from disclosure to weapon139 days
Published on NVDAug 23
1st PoC+139d
metasploit+838d
CISA KEV+1692d
Action required by CISAfederal deadline: 2022-05-02

Apply updates per vendor instructions.

In short

Telerik UI for ASP.NET AJAX uses weak encryption in its file upload feature, allowing attackers to upload malicious files or execute code on the server without proper authentication.

Technical detail

CVE-2017-11317 exploits weak encryption (CWE-326) in Telerik.Web.UI RadAsyncUpload component. Remote attackers can bypass security mechanisms to perform arbitrary file uploads or achieve remote code execution. The vulnerability affects Progress Telerik UI for ASP.NET AJAX versions before R1 2017 and R2 before R2 2017 SP2.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.