9.8

CVE-2017-11317: Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability

CVSS: 9.8v3.1CriticalKEVAnalyzed
Published 23-08-2017Last modified 21-10-2025
Open JSON

Vulnerability summary

CVE-2017-11317 is a critical (CVSS 9.8) Inadequate Encryption Strength vulnerability in Telerik User Interface (UI) for ASP.NET AJAX. It is known to be exploited: CISA lists it, first on 11-04-2022. EPSS estimates a 84.17% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
84.17%
0%100%
Critical · 0.00 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits3reference, exploit-database, metasploit

Timeline

  1. 23-08-2017
    PublishedVulnerability first disclosed.
  2. 11-04-2022
    Added to CISA KEVTelerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability
  3. 02-05-2022
    CISA remediation dueApply updates per vendor instructions.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

84.17%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 84.17% on 20-09-2026

20-09-202620-10-2026
EPSS score
84.17%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
11-04-2022
Federal due date
02-05-2022

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2017-11317

Public exploits

3 found
  • referenceUnverified

    Exploit Reference (packetstormsecurity.com)

    Maturity: unknown

  • exploit-databaseaspxUnverified

    Telerik UI for ASP.NET AJAX 2012.3.1308 < 2017.1.118 - Arbitrary File Upload

    Maturity: poc

  • MetasploitMetasploitremoteVerified

    Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization

    exploit/windows/http/telerik_rau_deserialization

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Telerik1 product

1 vendor · 1 product

References

5 links