CVEvulnerability
CVE-2014-4958
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-09-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in Telerik UI for ASP.NET AJAX RadEditor control 2014.1.403.35, 2009.3.1208.20, and other versions allows remote attackers to inject arbitrary web script or HTML via CSS expressions in style attributes.
Affected configurations
• telerik asp.net ajax radeditor control (<= 2014.1.403.35)
• telerik asp.net ajax radeditor control 2009.3.1208.20
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://blogs.telerik.com/blogs/14-09-24/securing-radeditor-content-and-preventing-xss-attacks blogs.telerik.com
- http://maverickblogging.com/disclosing-cve-2014-4958-stored-attribute-based-cross-site-scripting-xss-vulnerability-in-telerik-ui-for-asp-net-ajax-radeditor-control/ maverickblogging.com
- http://packetstormsecurity.com/files/128414/Telerik-ASP.NET-AJAX-RadEditor-Control-2014.1.403.35-XSS.html packetstormsecurity.com
- http://www.securityfocus.com/archive/1/533537/30/0/threaded www.securityfocus.com
- http://blogs.telerik.com/blogs/14-09-24/securing-radeditor-content-and-preventing-xss-attacks blogs.telerik.com
- http://maverickblogging.com/disclosing-cve-2014-4958-stored-attribute-based-cross-site-scripting-xss-vulnerability-in-telerik-ui-for-asp-net-ajax-radeditor-control/ maverickblogging.com
- http://packetstormsecurity.com/files/128414/Telerik-ASP.NET-AJAX-RadEditor-Control-2014.1.403.35-XSS.html packetstormsecurity.com
- http://www.securityfocus.com/archive/1/533537/30/0/threaded www.securityfocus.com