CVE-2018-14037

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2018-14037

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-14037.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2018-14037

Published

2018-09-28T00:29:00.773Z

Modified

2026-03-14T09:28:10.801538Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

Cross-site scripting (XSS) vulnerability in Progress Kendo UI Editor v2018.1.221 allows remote attackers to inject arbitrary JavaScript into the DOM of the WYSIWYG editor because of the editorNS.Serializer toEditableHtml function in kendo.all.min.js. If the victim accesses the editor, the payload gets executed. Furthermore, if the payload is reflected at any other resource that does rely on the sanitisation of the editor itself, the JavaScript payload will be executed in the context of the application. This allows attackers (in the worst case) to take over user sessions.

References

Affected packages

Git / github.com/telerik/kendo-ui-core

Affected ranges

Type

GIT

Repo

https://github.com/telerik/kendo-ui-core

Events

Introduced

Last affected

6b1a64060ba08079991c98b71fc6e3abc201ed31

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2018.1.221"
        }
    ]
}

Affected versions

2014.*

2014.2.716

2014.3.1119

2014.3.1411

2015.*

2015.1.225

2015.1.318

2015.2.624

2015.3.930

2016.*

2016.1.112

2016.2.607

2016.3.914

2017.*

2017.3.913

2018.*

2018.1.117

2018.1.221

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-14037.json"