CVE-2017-11317

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 84,2%

Kerentanan Inadequate Encryption Strength pada telerik ui for asp.net ajax. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 11 April 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

Rincian

Terbit di NVD

23 Agustus 2017

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-326: Inadequate Encryption Strength

EPSS (30 hari)

84,2% peluang dieksploitasi; lebih tinggi dari 99,6% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability

Masuk KEV

11 April 2022

Tenggat CISA

2 Mei 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/unrestricted-file-upload mitigasi · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11317 pemerintah AS
• http://packetstormsecurity.com/files/159653/Telerik-UI-ASP.NET-AJAX-RadAsyncUpload-Deserialization.html exploit · advisory pihak ketiga · vdb entry
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0006 advisory pihak ketiga
• https://www.exploit-db.com/exploits/43874/ exploit · advisory pihak ketiga · vdb entry