GHSA-9ww8-j8j2-3788Medium

YUI Cross-site Scripting (XSS) vulnerability

Published
May 13, 2022
Last Modified
April 12, 2025

🔗 CVE IDs covered (1)

CVE-2013-4942 →

📋 Description

Cross-site scripting (XSS) vulnerability in flashuploader.swf in the Uploader component in Yahoo! YUI 3.5.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.

🎯 Affected products5

  • npm/yui:>= 3.2.0, <= 3.9.1
  • composer/moodle/moodle:< 2.2.11
  • composer/moodle/moodle:>= 2.3.0, < 2.3.8
  • composer/moodle/moodle:>= 2.4.0-rc1, < 2.4.5
  • composer/moodle/moodle:>= 2.5.0-beta, < 2.5.1

🔗 References (5)