CVE-2024-12629

Summary

In Progress® Telerik® KendoReact versions v3.5.0 through v9.4.0, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection.

Affected Software

VendorProductVersion RangeStatus
Progress SoftwareTelerik KendoReact3.5.0 < 9.4.0affected

Weaknesses

  • CWE-1321: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References