PT-2014-6230 · Telerik · Telerik Ui For Asp.Net Ajax Radeditor

Publicado 2014-09-26 · Atualizado 2015-09-16 · CVE-2014-4958

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Telerik UI for ASP.NET AJAX RadEditor control versions 2009.3.1208.20 through 2014.1.403.35

Description The issue is related to a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via CSS expressions in style attributes.

Recommendations For versions 2009.3.1208.20 through 2014.1.403.35, consider disabling the RadEditor control until a patch is available to prevent exploitation. Restrict access to the control to minimize the risk of XSS attacks. Avoid using CSS expressions in style attributes in the affected RadEditor control until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-4958

Produtos afetados

Telerik Ui For Asp.Net Ajax Radeditor

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-4958 · Nota de Segurança
• http://blogs.telerik.com/blogs/14-09-24/securing-radeditor-content-and-preventing-xss-attacks · Nota
• http://packetstormsecurity.com/files/128414/Telerik-ASP.NET-AJAX-RadEditor-Control-2014.1.403.35-XSS.html · Nota
• http://maverickblogging.com/disclosing-cve-2014-4958-stored-attribute-based-cross-site-scripting-xss-vulnerability-in-telerik-ui-for-asp-net-ajax-radeditor-control · Nota
• http://securityfocus.com/archive/1/533537/30/0/threaded · Nota