Cross-Site Scripting in yui

Description

Affected versions of yui are vulnerable to cross-site scripting in the uploader.swf and io.swf utilities, via script injection in the url.

Recommendation

Update the yui package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.10.2
• Patched version(s): 3.10.3

References

• GHSA-mj87-8xf8-fp4w
• www.npmjs.com
• yuilibrary.com
• lists.apache.org
• moodle.org
• git.moodle.org
• CVE-2013-4939
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• YUI Cross-site Scripting (XSS) vulnerability - yui - GHSA-x5hj-47vv-53p8 - CVE-2013-4940
• YUI Cross-site Scripting (XSS) vulnerability - yui - CVE-2013-4941
• YUI Cross-site Scripting (XSS) vulnerability - CVE-2013-4942
• Cross-Site Scripting in react - react - CVE-2013-7035

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

yui