CVE-2014-2217

CVE-2014-2217 describes an absolute path traversal vulnerability in the RadAsyncUpload control within Telerik UI for ASP.NET AJAX versions prior to Q3 2012 SP2. This flaw allows unauthenticated remote attackers to write arbitrary files to the server by manipulating the UploadID metadata with a full pathname, which can lead to arbitrary code execution. The vulnerability has a CVSS score of 7.5 (High), indicating a low attack complexity and no authentication required, with potential impacts on confidentiality, integrity, and availability. Its EPSS score is low, suggesting a low probability of exploitation. Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. While there is limited community discussion and media coverage, one article links it to the Blue Mockingbird campaign, suggesting it may have been leveraged in specific attacks.