PT-2018-12293 · Progress · Kendo Ui Editor

M. Tomaselli · Publicado 2018-09-28 · Atualizado 2019-08-01 · CVE-2018-14037

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Progress Kendo UI Editor version 2018.1.221

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary JavaScript into the DOM of the WYSIWYG editor due to the editorNS.Serializer to toEditableHtml function in kendo.all.min.js. When a victim accesses the editor, the payload is executed. If the payload is reflected in other resources relying on the editor's sanitization, the JavaScript payload is executed in the application's context, potentially allowing attackers to take over user sessions.

Recommendations For Progress Kendo UI Editor version 2018.1.221, consider disabling the toEditableHtml function in kendo.all.min.js as a temporary workaround until a patch is available. Restrict access to the WYSIWYG editor to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-14037

Produtos afetados

Kendo Ui Editor

Referências · 6

• 🔥 https://sec-consult.com/en/blog/advisories/stored-cross-site-scripting-in-kendo-ui-editor-cve-2018-14037 · Exploit
• http://seclists.org/fulldisclosure/2018/Sep/49 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14037 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-14037 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-14037 · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2018/Sep/50 · Nota