Lucene search

[email protected]CVE-2014-2217

HistoryDec 25, 2014 - 9:59 p.m.

CVE-2014-2217

2014-12-2521:59:00

CWE-22

[email protected]

web.nvd.nist.gov

cve

2014

2217

path traversal

vulnerability

radasyncupload

radcontrols

telerik

asp.net ajax

arbitrary files

execute code

nvd

9.6 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.013 Low

EPSS

Percentile

86.0%

JSON

Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX before Q3 2012 SP2 allows remote attackers to write to arbitrary files, and consequently execute arbitrary code, via a full pathname in the UploadID metadata value.

CPENameOperatorVersion
telerik:ui_for_asp.net_ajaxtelerik ui for asp.net ajaxle2014.3.1209

CPE	Name	Operator	Version
telerik:ui_for_asp.net_ajax	telerik ui for asp.net ajax	le	2014.3.1209

References

itq.nl/arbitrary-file-write-in-telerik-ui-for-asp-net-ajax/

Social References

9.6 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.013 Low

EPSS

Percentile

86.0%

JSON

Related for CVE-2014-2217

prion2 cve1 ics1