Veille CVE
CVE-2017-11357
9.8 Critique Exploitée activement Utilisée par des rançongicielsCatalogue CISA KEV — Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability
Ajoutée le 26/01/2023 · Échéance de correction (agences US) : 16/02/2023
Action requise : Apply updates per vendor instructions.
Description
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 9.8 Critique | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 9.8 Critique | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | 7.5 Élevée | nvd@nist.gov (NVD) | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Faiblesses (CWE)
Références
- http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference MitigationVendor Advisory
- https://www.exploit-db.com/exploits/43874/ ExploitThird Party AdvisoryVDB Entry
- http://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference MitigationVendor Advisory
- https://www.exploit-db.com/exploits/43874/ ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11357 US Government Resource