ACTIVELY EXPLOITED
CVE-2017-11357: Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability
| Vendor | Telerik |
|---|---|
| Product | User Interface (UI) for ASP.NET AJAX |
| Actively exploited | Yes |
| Added to CISA KEV | 26 Jan 2023 |
| CISA federal deadline | 16 Feb 2023 |
| Ransomware use | Known |
| Weakness (CWE) | CWE-20 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.
SOURCES
Other Telerik flaws
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.