Unscored severity · published Dec 25, 2014
CVE-2014-2217
Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX before Q3 2012 SP2 allows remote attackers to write to…
–
CVSS
4.2%
EPSS
No
On KEV
Description
Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX before Q3 2012 SP2 allows remote attackers to write to arbitrary files, and consequently execute arbitrary code, via a full pathname in the UploadID metadata value.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.2% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TU
Telerik UI For Asp.net Ajax · Progress
through 2014.3.1209 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-2217
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-2217
Exploit
http://itq.nl/arbitrary-file-write-in-telerik-ui-for-asp-net-ajax/
More from Telerik UI For Asp.net Ajax
9.8
CVE-2019-18935
Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability
9.8
CVE-2017-11357
Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability
9.8
CVE-2026-6023
Deserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX
9.8
CVE-2021-28141
An issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224
9.8
CVE-2019-19790
Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with extension .BMP, .EXIF, .GIF, .ICON, .JPEG, .PNG, .TIFF, or .WMF…