CVE-2017-11357
KEV RANSOMWARECRITICAL 9.8EPSS 77.7%
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
- CVSS v3.1
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0
- 7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P - EPSS
- 77.68% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2023-01-26, used in ransomware campaigns
- Published
- 2017-08-23
- Updated
- 2026-08-14
Proof-of-concept exploits (4)
- SABUNMANDICYBERTEAM/telerik0★ · 2020-11-02
- ThanHuuTuan/CVE_2019_189352★ · 2020-05-29
- bao7uo/RAU_crypto180★ · 2020-08-22
- hnytgl/TelerikUI-RCE2★ · 2026-06-06