GitHub Advisoryadvisory · npm, Packagist

GHSA-x5hj-47vv-53p8 YUI Cross-site Scripting (XSS) vulnerability

MEDIUM Published 2022-05-13 Modified 2025-04-12 Official page ↗
Aliases
CVE-2013-4940
Ecosystem
npm, Packagist
Packages
yui, moodle/moodle
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weaknesses
CWE-79
Reviewed
2025-04-12

Affected packages

• npm yui: >= 3.0.0, < 3.10.11 → fixed in 3.10.11 • npm yui: >= 3.10.12, < 3.10.13 → fixed in 3.10.13 • Packagist moodle/moodle: < 2.2.11 → fixed in 2.2.11 • Packagist moodle/moodle: >= 2.3.0, < 2.3.8 → fixed in 2.3.8 • Packagist moodle/moodle: >= 2.4.0-rc1, < 2.4.5 → fixed in 2.4.5 • Packagist moodle/moodle: >= 2.5.0-beta, < 2.5.1 → fixed in 2.5.1

Description

Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL. NOTE: this vulnerability exists because of a CVE-2013-4939 regression.

Related

Alias · CVE (1)

  • CVE-2013-4940 Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References