CVE Watch—

CVE-2017-11357

Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability

CVSS

—

No CVSS

EPSS

75.7%

p99

KEV

YES

Jan 26, 2023

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

75.7%EPSS · 30 days75.7%

2026-06-302026-07-16

KEV catalog record

Product

Telerik / User Interface (UI) for ASP.NET AJAX

Vulnerability

Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability

Added to KEV

Jan 26, 2023

Remediate by

Feb 16, 2023

Known ransomware use

Yes

Summary description

Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.

Required action

Apply updates per vendor instructions.

Notes

https://docs.telerik.com/devtools/aspnet-ajax/knowledge-base/asyncupload-insecure-direct-object-reference; https://nvd.nist.gov/vuln/detail/CVE-2017-11357

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2017-11317—

99.7%

KEV—80Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability—