CVE-2020-11414
High
Description
An issue was discovered in Progress Telerik UI for Silverlight before 2020.1.330. The RadUploadHandler class in RadUpload for Silverlight expects a web request that provides the file location of the uploading file along with a few other parameters. The uploading file location should be inside the directory where the upload handler class is defined. Before 2020.1.330, a crafted web request could result in uploads to arbitrary locations.
SeverityHigh
CVSS7.5
Exploit probability—
ProductTelerik Ui For Silverlight
PublishedMar 31, 2020
First seenMar 31, 2020
How to fix
Update
- telerik ui_for_silverlight2020.1.330 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| telerik ui_for_silverlight | v < 2020.1.330 | 2020.1.330 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.