Description

Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

Remediation

References

CVE-2017-11357

Related Vulnerabilities

WordPress Plugin Email Subscribers by Icegram Express-Email Marketing, Newsletters, Automation for WordPress & WooCommerce SQL Injection (5.7.20)

WordPress Plugin Subscribe Form Remote Command Execution (1.1)

Jboss EAP CVE-2012-5626 Vulnerability (CVE-2012-5626)

TYPO3 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-7077)

WordPress Plugin Download Shortcode Local File Inclusion (0.2.3)

Severity

Critical

Classification

CVE-2017-11357 CWE-20 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities