CVE-2024-11628

Published: Feb 12, 2025Modified: Jun 17, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

In Progress® Telerik® Kendo UI for Vue versions v2.4.0 through v6.0.1, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection.

Affected (1)

Products: Progress: Kendo Ui For Vue

Progress

1 product

Kendo Ui For Vue

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Progress Kendo Ui For Vue	From 2.4.0 to 6.1.0

Related CWEs

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

References (1)

https://www.telerik.com/kendo-vue-ui/components/knowledge-base/kb-security-protoype-pollution-2024-11628

Source: security@progress.com

Vendor Advisory

Timeline

No history available yet.