GitHub Advisoryadvisory · npm

GHSA-mj87-8xf8-fp4w Cross-Site Scripting in yui

MEDIUM Published 2020-09-01 Modified 2020-08-31 Official page ↗
Aliases
CVE-2013-4939
Ecosystem
npm
Packages
yui
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm yui: < 3.10.3 → fixed in 3.10.3

Description

Affected versions of `yui` are vulnerable to cross-site scripting in the `uploader.swf` and `io.swf` utilities, via script injection in the url. Recommendation YUI has published their recommendation to fix this issue. Their recommendation is to: • Delete self-hosted copies of these files if you are not using them • Use the Yahoo! CDN hosted files • Use the patched files provided on the YUI Library here.

Related

Alias · CVE (1)

  • CVE-2013-4939 Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References