CVE-2017-11357

9.8CRITICAL

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary co

公開日: 8/23/2017更新日: 10/22/2025
NVDで表示MITREで表示

CISA既知の悪用された脆弱性

Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.

必要な対応:

Apply updates per vendor instructions.

期限:

2023-02-16

既知のランサムウェア使用

説明

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

AI分析AIによる分析

影響を受ける製品

telerikui_for_asp.net_ajax

利用可能なエクスプロイト (1)

参照