CVE-2017-11357 — n/a / n/a

Description (CNA)

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

Affected (CNA)

Vendor / product	Versions
n/a / n/a	affected n/a

CWE

No CWE identifiers supplied.

References

https://www.exploit-db.com/exploits/43874/
http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference

ADP enrichment

CVE

No English description supplied.

https://www.exploit-db.com/exploits/43874/
http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference

CISA-ADP

No English description supplied.

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11357