YUI Cross-site Scripting (XSS) vulnerability - yui - GHSA-x5hj-47vv-53p8

Description

Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.

Recommendation

Update the yui package to the latest compatible version. Followings are version details:

• Affected version(s): **= 3.10.12

  >= 3.0.0, <= 3.10.0**

• Patched version(s): **3.10.13

  3.10.11**

References

• GHSA-x5hj-47vv-53p8
• moodle.org
• git.moodle.org
• web.archive.org
• CVE-2013-4940
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• YUI Cross-site Scripting (XSS) vulnerability - CVE-2013-4942
• YUI Cross-site Scripting (XSS) vulnerability - yui - CVE-2013-4941
• TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection - CVE-2026-47761
• Bootstrap Cross-site Scripting vulnerability - bootstrap - GHSA-pj7m-g53m-7638 - CVE-2018-14041

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Tags:

npm

yui