Description

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

Remediation

References

CVE-2017-11317

Related Vulnerabilities

Atlassian Jira CVE-2021-26075 Vulnerability (CVE-2021-26075)

TYPO3 Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-2014-9508)

Oracle HTTP Server Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2021-4181)

WordPress Plugin Contest Gallery-Photo Contest for WordPress Cross-Site Scripting (14.1.7)

WordPress Plugin miniOrange's Google Authenticator-WordPress Two Factor Authentication (2FA, MFA, OTP SMS and Email)-Passwordless login Cross-Site Scripting (5.4.39)

Severity

Critical

Classification

CVE-2017-11317 CWE-326 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities