CRITICAL🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2017-11317

CVSS 9.8v3.1pub. 2017-08-23upd. 2026-04-21

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Telerik Ui For Asp.net Ajax

    APP
    Telerik
    2017.2.5032017.2.621≤ 2016.3.1027

CISA KEV — detailsi

Vendori
Telerik
Producti
User Interface (UI) for ASP.NET AJAX
Added to KEVi
April 11, 2022
Remediation deadline (US Federal)i
May 2, 2022(overdue)
Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
⏰CISA DEADLINE: 2 maja 2022
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2019-18935CRITICAL9.8⚠ KEVPL ✓same product

RCE przez .NET deserialization w Telerik UI for ASP.NET AJAX (RadAsyncUpload)

CVE-2017-9248CRITICAL9.8⚠ KEVPL ✓same product

Słaba ochrona kryptograficzna w Telerik UI for ASP.NET AJAX i Sitefinity

CVE-2024-4358CRITICAL9.8⚠ KEVPL ✓same vendor

Telerik Report Server – pominięcie uwierzytelniania (authentication bypass)

CVE-2019-19790CRITICAL9.8PL ✓same vendor

Path Traversal w RadChart (Telerik UI for ASP.NET AJAX) — odczyt i usuwanie plików graficznych

CVE-2024-10095HIGH8.4same vendor

In Progress Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1213), a code execution attack is possible th...