CVE-2013-4940 YUI Cross-site Scripting (XSS) vulnerability
MediumCVSS 4.3
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL. NOTE: this vulnerability exists because of a CVE-2013-4939 regression.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm yui(npm) | >= 3.0.0, < 3.10.11 | 3.10.11 |
| npm yui(npm) | >= 3.10.12, < 3.10.13 | 3.10.13 |
| npm yui(npm) | = 3.10.12 | No fix listed |
| moodle/moodle(Packagist) | < 2.2.11 | 2.2.11 |
| moodle/moodle(Packagist) | >= 2.3.0, < 2.3.8 | 2.3.8 |
| moodle/moodle(Packagist) | = v2.3.4 | No fix listed |
| moodle/moodle(Packagist) | = v2.3.5 | No fix listed |
| moodle/moodle(Packagist) | = v2.3.6 | No fix listed |
| moodle/moodle(Packagist) | = v2.3.7 | No fix listed |
| moodle/moodle(Packagist) | >= 2.4.0-rc1, < 2.4.5 | 2.4.5 |
| moodle/moodle(Packagist) | = v2.4.0 | No fix listed |
| moodle/moodle(Packagist) | = v2.4.0-rc1 | No fix listed |
| moodle/moodle(Packagist) | = v2.4.1 | No fix listed |
| moodle/moodle(Packagist) | = v2.4.2 | No fix listed |
| moodle/moodle(Packagist) | = v2.4.3 | No fix listed |
| moodle/moodle(Packagist) | = v2.4.4 | No fix listed |
| moodle/moodle(Packagist) | >= 2.5.0-beta, < 2.5.1 | 2.5.1 |
| moodle/moodle(Packagist) | = v2.5.0 | No fix listed |
| moodle/moodle(Packagist) | = v2.5.0-beta | No fix listed |
| moodle/moodle(Packagist) | = v2.5.0-rc1 | No fix listed |
| moodle/moodle | = 2.1.0 | No fix listed |
| moodle/moodle | = 2.1.1 | No fix listed |
| moodle/moodle | = 2.1.2 | No fix listed |
| moodle/moodle | = 2.1.3 | No fix listed |
| moodle/moodle | = 2.1.4 | No fix listed |
Show 54 more
| Product | Affected versions | Fixed in |
|---|---|---|
| moodle/moodle | = 2.1.5 | No fix listed |
| moodle/moodle | = 2.1.6 | No fix listed |
| moodle/moodle | = 2.1.7 | No fix listed |
| moodle/moodle | = 2.1.8 | No fix listed |
| moodle/moodle | = 2.1.9 | No fix listed |
| moodle/moodle | = 2.1.10 | No fix listed |
| moodle/moodle | = 2.2.0 | No fix listed |
| moodle/moodle | = 2.2.1 | No fix listed |
| moodle/moodle | = 2.2.2 | No fix listed |
| moodle/moodle | = 2.2.3 | No fix listed |
| moodle/moodle | = 2.2.4 | No fix listed |
| moodle/moodle | = 2.2.5 | No fix listed |
| moodle/moodle | = 2.2.6 | No fix listed |
| moodle/moodle | = 2.2.7 | No fix listed |
| moodle/moodle | = 2.2.8 | No fix listed |
| moodle/moodle | = 2.2.9 | No fix listed |
| moodle/moodle | = 2.2.10 | No fix listed |
| moodle/moodle | = 2.3.0 | No fix listed |
| moodle/moodle | = 2.3.1 | No fix listed |
| moodle/moodle | = 2.3.2 | No fix listed |
| moodle/moodle | = 2.3.3 | No fix listed |
| moodle/moodle | = 2.3.4 | No fix listed |
| moodle/moodle | = 2.3.5 | No fix listed |
| moodle/moodle | = 2.3.6 | No fix listed |
| moodle/moodle | = 2.3.7 | No fix listed |
| moodle/moodle | = 2.4.0 | No fix listed |
| moodle/moodle | = 2.4.1 | No fix listed |
| moodle/moodle | = 2.4.2 | No fix listed |
| moodle/moodle | = 2.4.3 | No fix listed |
| moodle/moodle | = 2.4.4 | No fix listed |
| moodle/moodle | = 2.5.0 | No fix listed |
| yahoo yui | = 3.0.0 | No fix listed |
| yahoo yui | = 3.1.0 | No fix listed |
| yahoo yui | = 3.1.1 | No fix listed |
| yahoo yui | = 3.1.2 | No fix listed |
| yahoo yui | = 3.2.0 | No fix listed |
| yahoo yui | = 3.3.0 | No fix listed |
| yahoo yui | = 3.4.0 | No fix listed |
| yahoo yui | = 3.4.1 | No fix listed |
| yahoo yui | = 3.5.0 | No fix listed |
| yahoo yui | = 3.5.1 | No fix listed |
| yahoo yui | = 3.6.0 | No fix listed |
| yahoo yui | = 3.7.0 | No fix listed |
| yahoo yui | = 3.7.1 | No fix listed |
| yahoo yui | = 3.7.2 | No fix listed |
| yahoo yui | = 3.7.3 | No fix listed |
| yahoo yui | = 3.8.0 | No fix listed |
| yahoo yui | = 3.8.1 | No fix listed |
| yahoo yui | = 3.9.0 | No fix listed |
| yahoo yui | = 3.9.1 | No fix listed |
| yahoo yui | = 3.10.0 | No fix listed |
| yahoo yui | = 3.10.1 | No fix listed |
| yahoo yui | = 3.10.2 | No fix listed |
| npm yui(npm) | >= 3.0.0, <= 3.10.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- moodle.org vendor-advisory
- web.archive.org
- git.moodle.org
- yuilibrary.com patch vendor-advisory
- github.com