CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2017-08-23
Progress Telerik UI for ASP.NET AJAX RadAsyncUpload Unrestricted File Upload and Remote Code Execution (RCE) Vulnerability (CVE-2017-11357)
[Affected Scope] Progress Telerik UI for ASP.NET AJAX versions prior to R2 2017 SP2
[Impact] Unauthenticated remote attackers can exploit the vulnerable RadAsyncUpload component to upload arbitrary malicious files (such as ASPX webshells) and execute arbitrary code with web server privileges
[Mitigation] Immediately upgrade Telerik UI for ASP.NET AJAX to R2 2017 SP2 or later, or apply workarounds by disabling RadAsyncUpload and hardening encryption keys