PT-2020-12600
CVE-2020-11414
·
تاريخ النشر
2020-03-31
·
تاريخ التحديث
2020-04-02
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions
Progress Telerik UI for Silverlight versions prior to 2020.1.330
Description
An issue was discovered in the RadUploadHandler class in RadUpload for Silverlight, where a crafted web request could result in uploads to arbitrary locations. The uploading file location should be inside the directory where the upload handler class is defined, but before version 2020.1.330, this expectation could be bypassed.
Recommendations
For versions prior to 2020.1.330, update to version 2020.1.330 or later to resolve the issue. As a temporary workaround, consider restricting access to the RadUploadHandler class to minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾