What is CVE-2024-11628?

CVE-2024-11628 is a medium-severity vulnerability in Progress Kendo_ui_for_vue, classified under Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). CVSS score: 4.1/10. Published 2025-02-12.

How severe is CVE-2024-11628?

Medium severity. CVSS v3 base score is 4.1 out of 10.

Prototype Pollution in Progress Kendo_ui_for_vue

CVE-2024-11628

In Progress® Telerik® Kendo UI for Vue versions v2.4.0 through v6.0.1, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection.

Vulnerability class: Prototype Pollution

EPSS: 0.007 (49.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.1 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L.

Affected products

Progress Kendo_ui_for_vue
Progress Software Progress® Telerik® Kendo Ui For Vue — versions 2.4.0

Weakness classification (CWE)

CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

References

security@progress.com (vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2024-11628?: CVE-2024-11628 is a medium-severity vulnerability in Progress Kendo_ui_for_vue, classified under Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). CVSS score: 4.1/10. Published 2025-02-12.
How severe is CVE-2024-11628?: Medium severity. CVSS v3 base score is 4.1 out of 10.