CVE-2020-11414

An issue was discovered in Progress Telerik UI for Silverlight before 2020.1.330. The RadUploadHandler class in RadUpload for Silverlight expects a web request that provides the file location of the uploading file along with a few other parameters. The uploading file location should be inside the directory where the upload handler class is defined. Before 2020.1.330, a crafted web request could result in uploads to arbitrary locations.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://docs.telerik.com/devtools/silverlight/controls/radupload/how-to/secure-upload-file-path	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:telerik:ui_for_silverlight:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-03-31 13:15

Updated : 2024-02-04 21:00

NVD link : CVE-2020-11414

Mitre link : CVE-2020-11414

CVE.ORG link : CVE-2020-11414

JSON object : View

Products Affected

telerik

ui_for_silverlight

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2020-11414", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2020-03-31T13:15:13.177", "references": [{"url": "https://docs.telerik.com/devtools/silverlight/controls/radupload/how-to/secure-upload-file-path", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Progress Telerik UI for Silverlight before 2020.1.330. The RadUploadHandler class in RadUpload for Silverlight expects a web request that provides the file location of the uploading file along with a few other parameters. The uploading file location should be inside the directory where the upload handler class is defined. Before 2020.1.330, a crafted web request could result in uploads to arbitrary locations."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Progress Telerik UI for Silverlight versiones anteriores a 2020.1.330. La clase RadUploadHandler en RadUpload para Silverlight espera una petici\u00f3n web que provea la ubicaci\u00f3n de archivo del archivo de carga junto con algunos otros par\u00e1metros. La ubicaci\u00f3n del archivo de carga debe estar dentro del directorio donde es definida la clase del manejador de carga. Antes de la versi\u00f3n 2020.1.330, una petici\u00f3n web dise\u00f1ada podr\u00eda resultar en cargas en ubicaciones arbitrarias."}], "lastModified": "2020-04-02T16:57:06.823", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:telerik:ui_for_silverlight:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A08D476E-5D13-4E6A-95C9-E03C3250E023", "versionEndExcluding": "2020.1.330"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}