CVE-2018-14037

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2018-14037

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-14037.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2018-14037

Published

2018-09-28T00:29:00.773Z

Modified

2026-07-08T16:27:59.183663Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

Cross-site scripting (XSS) vulnerability in Progress Kendo UI Editor v2018.1.221 allows remote attackers to inject arbitrary JavaScript into the DOM of the WYSIWYG editor because of the editorNS.Serializer toEditableHtml function in kendo.all.min.js. If the victim accesses the editor, the payload gets executed. Furthermore, if the payload is reflected at any other resource that does rely on the sanitisation of the editor itself, the JavaScript payload will be executed in the context of the application. This allows attackers (in the worst case) to take over user sessions.

References

Affected packages

Git / github.com/telerik/kendo-ui-core

Affected ranges

Type

GIT

Repo

https://github.com/telerik/kendo-ui-core

Events

Introduced

6b1a64060ba08079991c98b71fc6e3abc201ed31

Last affected

6b1a64060ba08079991c98b71fc6e3abc201ed31

Database specific

{
    "cpe": "cpe:2.3:a:progress:kendo_ui:2018.1.221:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "2018.1.221"
        },
        {
            "last_affected": "2018.1.221"
        }
    ]
}

Affected versions

2018.*

2018.1.221

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-14037.json"