LiveActive security incident?Get immediate response
CVE Record

CVE-2020-11414: An issue was discovered in Progress Telerik UI for Silverlight before 2020.1.330.

An issue was discovered in Progress Telerik UI for Silverlight before 2020.1.330. The RadUploadHandler class in RadUpload for Silverlight expects a web request that provides the file location of the uploading file along with a few other parameters. The uploading file location should be inside the directory where the upload handler class is defined. Before 2020.1.330, a crafted web request could result in uploads to arbitrary locations.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2020-11414 affects legacy Progress Telerik UI for Silverlight. A crafted upload request could make the upload handler place files outside the intended directory. For a business, the concern is unauthorized file writes on servers that still expose this component.

Executive priority

Prioritize remediation for any internet-facing or partner-facing system using this legacy upload component. Internal-only systems still need review because arbitrary file placement can create integrity and operational risk, but urgency depends on reachability and privileges.

Technical view

Before 2020.1.330, RadUploadHandler in RadUpload for Silverlight did not adequately constrain the supplied upload file location to the handler directory. The CVE describes crafted web requests causing uploads to arbitrary locations. No CVSS, CWE, or detailed affected CPE data is provided in the bundle.

Likely exposure

Exposure is most likely in older applications using Progress Telerik UI for Silverlight RadUpload before 2020.1.330, especially where RadUploadHandler remains reachable from untrusted networks. Silverlight is legacy technology, so risk may concentrate in older internal or customer-facing line-of-business systems.

Exploitation context

The source bundle does not show KEV listing or cited active exploitation. It states exploitation requires a crafted web request to the upload handler. Impact depends on server file permissions, handler reachability, and whether writable paths could affect application behavior or hosted content.

Researcher notes

The bundle provides a concise root-cause description but lacks CVSS, CWE mapping, CPEs, exploit reports, and detailed fix mechanics. Treat product and version evidence from the CVE description as authoritative, then validate implementation details against the Telerik secure upload file path reference.

Mitigation direction

  • Upgrade Telerik UI for Silverlight to 2020.1.330 or later where applicable.
  • Review Progress Telerik guidance for securing RadUpload file paths.
  • Restrict access to RadUploadHandler where it is not required publicly.
  • Audit server write permissions used by the upload handler.
  • Remove or retire unused Silverlight upload functionality.

Validation and detection

  • Inventory applications using Progress Telerik UI for Silverlight RadUpload.
  • Confirm deployed Telerik UI for Silverlight versions are 2020.1.330 or later.
  • Identify whether RadUploadHandler endpoints are reachable from untrusted networks.
  • Review upload handler configuration against Telerik secure file path guidance.
  • Check server logs for unusual upload requests or unexpected file destinations.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-11414 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.