IM
IronMonkey Threat Research

CVE-2014-4958 MEDIUM

Published: 2014-09-26 | Last Modified: 2026-06-17 | Status: Modified

Description

Cross-site scripting (XSS) vulnerability in Telerik UI for ASP.NET AJAX RadEditor control 2014.1.403.35, 2009.3.1208.20, and other versions allows remote attackers to inject arbitrary web script or HTML via CSS expressions in style attributes.

Additional Descriptions (1)

Vulnerabilidad de XSS en Telerik UI para ASP.NET AJAX RadEditor control 2014.1.403.35, 2009.3.1208.20 y otras versiones permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de expresiones CCS en atributos de estilo.

CVSS Metrics

Base Score: 4.3 (MEDIUM)

AV:N/AC:M/Au:N/C:N/I:P/A:N

Access VectorNETWORK
Access ComplexityMEDIUM
AuthenticationNONE
Confidentiality ImpactNONE
Integrity ImpactPARTIAL
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 8.6

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-79

Affected Products

Vendor Product Version Update Type
telerik asp.net_ajax_radeditor_control * <built-in method update of dict object at 0x72a9cc7ee580> Application
telerik asp.net_ajax_radeditor_control 2009.3.1208.20 <built-in method update of dict object at 0x72a9cc7ecf00> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:telerik:asp.net_ajax_radeditor_control:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:telerik:asp.net_ajax_radeditor_control:2009.3.1208.20:*:*:*:*:*:*:*

References

Notification
Message here