CVE-2017-11357

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
Configurations

Configuration 1 (hide)

cpe:2.3:a:telerik:ui_for_asp.net_ajax:*:*:*:*:*:*:*:*

History

28 Jun 2024, 13:44

Type Values Removed Values Added
CWE CWE-20 CWE-434
References () https://www.exploit-db.com/exploits/43874/ - () https://www.exploit-db.com/exploits/43874/ - Exploit, Third Party Advisory, VDB Entry

Information

Published : 2017-08-23 17:29

Updated : 2024-06-28 13:44


NVD link : CVE-2017-11357

Mitre link : CVE-2017-11357

CVE.ORG link : CVE-2017-11357


JSON object : View

Products Affected

telerik

  • ui_for_asp.net_ajax
CWE
CWE-434

Unrestricted Upload of File with Dangerous Type