CVE-2017-11357 — Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability

Known ransomware use CISA KEV listed Added January 26, 2023 Remediate by February 16, 2023

Description

Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.

Required action

Apply updates per vendor instructions.

Notes

https://docs.telerik.com/devtools/aspnet-ajax/knowledge-base/asyncupload-insecure-direct-object-reference; https://nvd.nist.gov/vuln/detail/CVE-2017-11357

Need help remediating this vulnerability?

Our team helps organizations patch, mitigate, and respond to CISA KEV advisories fast.

Talk to an engineer