Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-14037: Progress Kendo UI Editor can run injected JavaScript

CVE-2018-14037 · published 8 years ago

Summary

The web editor component in Progress Kendo UI (version 2018.1.221) does not properly clean up built‑in HTML, so a malicious page can slip in its own JavaScript code. When a user opens the editor, the hidden code runs with the same permissions as the application, potentially letting an attacker hijack the user's session. Update to a patched version of Kendo UI or apply the vendor's recommended configuration changes to block the unsafe content.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
progress	kendo_ui	2018.1.221 `cpe:2.3:a:progress:kendo_ui:2018.1.221:::::::*`

Original advisory text

Cross-site scripting (XSS) vulnerability in Progress Kendo UI Editor v2018.1.221 allows remote attackers to inject arbitrary JavaScript into the DOM of the WYSIWYG editor because of the editorNS.Serializer toEditableHtml function in kendo.all.min.js. If the victim accesses the editor, the payload gets executed. Furthermore, if the payload is reflected at any other resource that does rely on the sanitisation of the editor itself, the JavaScript payload will be executed in the context of the application. This allows attackers (in the worst case) to take over user sessions.

References

http://seclists.org/fulldisclosure/2018/Sep/49 Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2018/Sep/50 Mailing List Third Party Advisory
https://www.sec-consult.com/en/blog/advisories/stored-cross-site-scripting-in-ke... Exploit Technical Description Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.1 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published28 Sep 2018

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2018-14037 · NVD

Track software like this

Free during beta