CVE-2017-11317

telerik ui for asp.net ajax

Published 23 Aug 2017 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 11 Apr 2022, with a remediation deadline of 2 May 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

References

packetstormsecurity.com/files/159653/Telerik-UI-ASP.NET-AJAX-RadAsyncUpload-Deserialization.html · Exploit, Third Party Advisory, VDB Entry
www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/unrestricted-file-upload · Mitigation, Vendor Advisory
psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0006 · Third Party Advisory
www.exploit-db.com/exploits/43874/ · Exploit, Third Party Advisory, VDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11317 · US Government Resource