1 Answer, 1 is accepted
Hi Ratan,
All Telerik.Web.UI releases after R1 2019 include a custom jQuery version (1.12.4) that implements backports to address the known jQuery vulnerabilities. Although, we tried to upgrade to jQuery 3 that didn't go well due to Microsoft AJAX limitations in the ASP.NET WebForms framework, so we had to revert to jQuery 1.12.4.
In the jQuery Version History in Telerik UI Controls, you can find the history of the different jQuery versions we used in the previous versions, and in the Embedded jQuery Security section the jQuery vulnerabilities we have fixed along with their CVEs, e.g.
As of R1 2019, Telerik UI for ASP.NET AJAX ships a custom jQuery 1.12.4, with backport fixes incorporated to eliminate known vulnerability issues for 1.12.4 version. Here is a list of security fixes introduced to the custom jQuery script embedded in the Telerik.Web.UI assembly and their related CVE reports:
Best CVE-2020-11022,CVE-2020-11023Cross-site scripting (XSS) vulnerability in jQuery.htmlPrefilter fixed in jQuery 3.5 - from version R2 2020CVE-2015-9251jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed - from version R1 2019CVE-2019-11358Query before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable__proto__property, it could extend the native Object.prototype - from version R1 2019
If you do not want to stick with jQuery 1.12.4, configure the Telerik Ajax controls to use an external jQuery. You can disable the embedded jQuery library and include an external one as a replacement. This lets you use your own version for the $telerik.$ variable, which exposes the embedded jQuery library. That way you can have complete control over the used version of jQuery. You can find instructions on how to use external jQuery in the Including external jQuery section.
Best
Regards,
Rumen
Progress Telerik
Rank 1
has reached end-of-life status, no longer receives security updates, and has known security issues?
Hi Danny,
The embedded jQuery has addressed all the security vulnerabilities and it is safe to use. The official documentation confirms that. Scanning applications may detect it still, but you can ignore it or exclude it from scanning. You can choose the one that is best for you.