CVE-2017-11317

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

• CWE-326
• CWE-326

• http://packetstormsecurity.com/files/159653/Telerik-UI-ASP.NET-AJAX-RadAsyncUpload-Deserialization.htmlExploit, Third Party Advisory, VDB Entry
• http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/unrestricted-file-uploadMitigation, Vendor Advisory
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0006Third Party Advisory
• https://www.exploit-db.com/exploits/43874/Exploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/159653/Telerik-UI-ASP.NET-AJAX-RadAsyncUpload-Deserialization.htmlExploit, Third Party Advisory, VDB Entry
• http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/unrestricted-file-uploadMitigation, Vendor Advisory
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0006Third Party Advisory
• https://www.exploit-db.com/exploits/43874/Exploit, Third Party Advisory, VDB Entry
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11317US Government Resource

Published

Aug 23, 2017

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-11307Adobe Acrobat and Reader versions 2017.012.20098 and earlier…9.8
• CVE-2017-11308Adobe Acrobat and Reader versions 2017.012.20098 and earlier…9.8
• CVE-2017-11309Buffer overflow in the SoftConsole client in Avaya IP Office…
• CVE-2017-1131IBM Sterling B2B Integrator Standard Edition 5.2 could allow…
• CVE-2017-11310The read_user_chunk_callback function in coders\png.c in Ima…
• CVE-2017-11311soundlib/Load_psm.cpp in OpenMPT through 1.26.12.00 and libo…
• CVE-2017-11318Cobian Backup 11 client allows man-in-the-middle attackers t…
• CVE-2017-11319Perspective ICM Investigation & Case 5.1.1.16 allows remote …
• CVE-2017-1132IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerab…
• CVE-2017-11320Persistent XSS through the SSID of nearby Wi-Fi devices on T…
• CVE-2017-11321The restricted shell interface in UCOPIA Wireless Appliance …7.2
• CVE-2017-11322The chroothole_client executable in UCOPIA Wireless Applianc…