Skip to content

Commit a9fdfcc

Browse files
kendo-botkendo-bot
committed
Sync with Kendo UI Professional
1 parent af0e394 commit a9fdfcc

File tree

4 files changed

+90
-0
lines changed

4 files changed

+90
-0
lines changed

‎docs-aspnet/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
title: Cross-Site Scripting (XSS) Vulnerability (6725)
3+
description: "How to mitigate CVE-2025-6725, a Cross-Site Scripting (XSS) vulnerability."
4+
slug: kb-security-pdfviewer-xss-cve-2025-6725
5+
res_type: kb
6+
---
7+
8+
## Description
9+
10+
Security Notification – July 2025 - [CVE-2025-6725](https://www.cve.org/CVERecord?id=CVE-2025-6725)
11+
12+
- Progress® Telerik® UI for {{ site.framework }} (2025.2.520) or earlier.
13+
14+
### What Are the Impacts
15+
16+
In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that requires the DOM to be re-rendered.
17+
18+
## Issue
19+
20+
CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
21+
22+
## Solution
23+
24+
We have addressed the issue and the Progress team strongly recommends performing an upgrade to the latest version listed in the table below.
25+
26+
| Current Version | Update to |
27+
|-----------------|----------|
28+
| `>= v2024.4.1112` && `<= v2025.2.520` | `>= v2025.2.702` |
29+
30+
Follow the [update instructions]({% slug upgrade_aspnetcore %}) for precise instructions. All customers who have a license can access the downloads here [Product Downloads | Your Account](https://www.telerik.com/account/downloads/product-download).
31+
32+
## Notes
33+
34+
- If you do not use the PdfViewer in your application, the application is not vulnerable.
35+
- If you have any questions or concerns related to this issue, open a new Technical Support case in [Your Account | Support Center](https://www.telerik.com/account/support-center/contact-us/). Technical Support is available to customers with an active support plan.
36+
- We would like to thank ATTRIBUTION for responsibly disclosing this vulnerability.
37+
38+
## External References
39+
40+
[CVE-2025-6725](https://www.cve.org/CVERecord?id=CVE-2025-6725) (MEDIUM)
41+
42+
**CVSS:** 5.4
43+
44+
In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that requires the DOM to be re-rendered.

‎docs-aspnet/styles-and-layout/sass-themes/compatibility.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ The following table lists the Telerik UI for {{ site.framework }} versions and t
1010

1111
| Telerik UI for {{ site.framework }} | Kendo UI Sass Themes |
1212
|:--- |:--- |
13+
| Telerik UI 2025.2.702 (2025.2.702) | @progress/kendo-theme-bootstrap@11.0.2<br>@progress/kendo-theme-classic@11.0.2<br>@progress/kendo-theme-default@11.0.2<br>@progress/kendo-theme-fluent@11.0.2<br>@progress/kendo-theme-material@11.0.2 |
1314
| Telerik UI 2025.2.520 (Q2 2025.2.520) | @progress/kendo-theme-bootstrap@11.0.2<br>@progress/kendo-theme-classic@11.0.2<br>@progress/kendo-theme-default@11.0.2<br>@progress/kendo-theme-fluent@11.0.2<br>@progress/kendo-theme-material@11.0.2 |
1415
| Telerik UI 2025.1.227 (2025.1.227) | @progress/kendo-theme-bootstrap@10.2.0<br>@progress/kendo-theme-classic@10.2.0<br>@progress/kendo-theme-default@10.2.0<br>@progress/kendo-theme-fluent@10.2.0<br>@progress/kendo-theme-material@10.2.0 |
1516
| Telerik UI 2025.1.211 (Q1 2025) | @progress/kendo-theme-bootstrap@10.2.0<br>@progress/kendo-theme-classic@10.2.0<br>@progress/kendo-theme-default@10.2.0<br>@progress/kendo-theme-fluent@10.2.0<br>@progress/kendo-theme-material@10.2.0 |

‎docs/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
title: Cross-Site Scripting (XSS) Vulnerability (6725)
3+
description: "How to mitigate CVE-2025-6725, a Cross-Site Scripting (XSS) vulnerability."
4+
slug: kb-security-pdfviewer-xss-cve-2025-6725
5+
res_type: kb
6+
---
7+
8+
## Description
9+
10+
Security Notification – July 2025 - [CVE-2025-6725](https://www.cve.org/CVERecord?id=CVE-2025-6725)
11+
12+
- Progress® Kendo® UI for jQuery (2025.2.520) or earlier.
13+
14+
### What Are the Impacts
15+
16+
In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that requires the DOM to be re-rendered.
17+
18+
## Issue
19+
20+
CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
21+
22+
## Solution
23+
24+
We have addressed the issue and the Progress team strongly recommends performing an upgrade to the latest version listed in the table below.
25+
26+
| Current Version | Update to |
27+
|-----------------|----------|
28+
| `>= v2024.4.1112` && `<= v2025.2.520` | `>= v2025.2.702` |
29+
30+
Follow the [update instructions]({% slug kendoui_npm_packages_kendoui_installation %}) for precise instructions. All customers who have a license can access the downloads here [Product Downloads | Your Account](https://www.telerik.com/account/downloads/product-download).
31+
32+
## Notes
33+
34+
- If you do not use the PdfViewer in your application, the application is not vulnerable.
35+
- If you have any questions or concerns related to this issue, open a new Technical Support case in [Your Account | Support Center](https://www.telerik.com/account/support-center/contact-us/). Technical Support is available to customers with an active support plan.
36+
- We would like to thank ATTRIBUTION for responsibly disclosing this vulnerability.
37+
38+
## External References
39+
40+
[CVE-2025-6725](https://www.cve.org/CVERecord?id=CVE-2025-6725) (MEDIUM)
41+
42+
**CVSS:** 5.4
43+
44+
In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that requires the DOM to be re-rendered.

‎docs/styles-and-layout/sass-themes/compatibility.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ The following table lists the Kendo UI for jQuery and Kendo UI Sass themes versi
1313

1414
| kendo UI for jQuery | Kendo UI Sass Themes |
1515
|:--- |:--- |
16+
| Kendo UI 2025.2.702 (2025.2.702) | @progress/kendo-theme-bootstrap@11.0.2<br>@progress/kendo-theme-classic@11.0.2<br>@progress/kendo-theme-default@11.0.2<br>@progress/kendo-theme-fluent@11.0.2<br>@progress/kendo-theme-material@11.0.2 |
1617
| Kendo UI 2025.2.520 (Q2 2025.2.520) | @progress/kendo-theme-bootstrap@11.0.2<br>@progress/kendo-theme-classic@11.0.2<br>@progress/kendo-theme-default@11.0.2<br>@progress/kendo-theme-fluent@11.0.2<br>@progress/kendo-theme-material@11.0.2 |
1718
| Kendo UI 2025.1.227 (2025.1.227) | @progress/kendo-theme-bootstrap@10.2.0<br>@progress/kendo-theme-classic@10.2.0<br>@progress/kendo-theme-default@10.2.0<br>@progress/kendo-theme-fluent@10.2.0<br>@progress/kendo-theme-material@10.2.0 |
1819
| Kendo UI 2025.1.211 (Q1 2025) | @progress/kendo-theme-bootstrap@10.2.0<br>@progress/kendo-theme-classic@10.2.0<br>@progress/kendo-theme-default@10.2.0<br>@progress/kendo-theme-fluent@10.2.0<br>@progress/kendo-theme-material@10.2.0 |

0 commit comments

Comments
 (0)