PT-2017-3939 · Progress · Telerik Ui For Asp.Net Ajax

Paul Taylor

·

Publicado

2017-08-22

·

Atualizado

2025-03-14

·

CVE-2017-11357

CVSS v3.1

10

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Progress Telerik UI for ASP.NET AJAX versions prior to R2 2017 SP2
Description The issue is related to insufficient input validation in the RadAsyncUpload component, allowing remote attackers to perform arbitrary file uploads or execute arbitrary code. This can be exploited by a remote attacker to gain unauthorized access or execute malicious code.
Recommendations For versions prior to R2 2017 SP2, update to R2 2017 SP2 or later to resolve the issue. As a temporary workaround, consider restricting access to the RadAsyncUpload component to minimize the risk of exploitation.

Exploit

Correção

RCE

Unrestricted File Upload

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20CWE-434

Identificadores relacionados

BDU:2020-02118
CVE-2017-11357

Produtos afetados

Telerik Ui For Asp.Net Ajax