CVE-2017-11357

Timeline

Detection, updates, and resolution for this record.

1. Aug 23, 2017 · Catalog

   Detected

   Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

2. Jan 26, 2023 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Feb 16, 2023 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Aug 13, 2026 · Catalog

   Updated

   Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

Affected

• cpe progress/telerik ui for asp.net ajaxversion unspecified
• vendor Telerik User Interface (UI) for ASP.NET AJAXversion unspecified

Sources

• CISA KEVCVE-2017-11357

  Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.

  cisa.gov
• CVE.orgCVE-2017-11357

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2017-11357

  30-day exploitation probability 77.7%

  first.org
• Exploit Database43874

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• NIST NVDCVE-2017-11357

  Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

  nvd.nist.gov

References

• Mitigation · telerik.com
• CISA note · docs.telerik.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• Exploit · exploit-db.com