CVE-2017-11357
Critical 9.8 Exploited in the wild (KEV) Used in ransomware campaigns
Confirmed active exploitation — CISA KEV catalog
- Name
- Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
Metrics
- CVSS 3.1
-
9.8 (CRITICAL)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 78% (percentile: 100) as of 1 November 2026
- CWE
- CWE-434
Affected products
progress: telerik ui for asp.net ajax
References
- http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecu… MitigationVendor Advisory
- http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecu… MitigationVendor Advisory
- https://www.exploit-db.com/exploits/43874/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/43874/ ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017… US Government Resource