GitHub Advisoryadvisory · npm, Packagist

GHSA-64r3-582j-frqm YUI Cross-site Scripting (XSS) vulnerability

MEDIUM Published 2022-05-13 Modified 2025-04-12 Official page ↗
Aliases
CVE-2013-4941
Ecosystem
npm, Packagist
Packages
yui, moodle/moodle
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weaknesses
CWE-79
Reviewed
2025-04-12

Affected packages

• npm yui: >= 3.2.0, <= 3.9.1 (no fix yet) • Packagist moodle/moodle: < 2.2.11 → fixed in 2.2.11 • Packagist moodle/moodle: >= 2.3.0, < 2.3.8 → fixed in 2.3.8 • Packagist moodle/moodle: >= 2.4.0-rc1, < 2.4.5 → fixed in 2.4.5 • Packagist moodle/moodle: >= 2.5.0-beta, < 2.5.1 → fixed in 2.5.1

Description

Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 3.2.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.

Related

Alias · CVE (1)

  • CVE-2013-4941 Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References