CVE-2017-11357Used in ransomware
TE
Telerik User Interface (UI) for ASP.NET AJAX
Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability
What it is
Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.
What to do
Apply updates per vendor instructions.
Vendor notices and references
- docs.telerik.com/devtools/aspnet-ajax/knowledge-base/asyncupload-insecure-direct-object-re
- nvd.nist.gov/vuln/detail/CVE-2017-11357
Description and required action as published by CISA. Full record at NVD.