PT-2013-5287 · Yahoo+1 · Yui+1

Andrew Nicols · Published 2013-07-26 · Updated 2020-12-01 · CVE-2013-4939

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions YUI versions 3.0.0 through 3.9.1 Moodle versions prior to 2.1.10 Moodle versions 2.2.x prior to 2.2.11 Moodle versions 2.3.x prior to 2.3.8 Moodle versions 2.4.x prior to 2.4.5 Moodle versions 2.5.x prior to 2.5.1

Description A cross-site scripting (XSS) issue exists in the IO Utility component, specifically in io.swf, allowing remote attackers to inject arbitrary web script or HTML via a crafted string in a URL. This affects various products, including Moodle, that utilize YUI. The uploader.swf and io.swf utilities are vulnerable to script injection in the URL.

Recommendations For YUI versions 3.0.0 through 3.9.1: Delete self-hosted copies of the vulnerable files if not in use, use the Yahoo! CDN hosted files, or use the patched files provided by YUI. For Moodle versions prior to 2.1.10: Update to version 2.1.10 or later. For Moodle versions 2.2.x prior to 2.2.11: Update to version 2.2.11 or later. For Moodle versions 2.3.x prior to 2.3.8: Update to version 2.3.8 or later. For Moodle versions 2.4.x prior to 2.4.5: Update to version 2.4.5 or later. For Moodle versions 2.5.x prior to 2.5.1: Update to version 2.5.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-4939

GHSA-MJ87-8XF8-FP4W

Affected Products

Moodle

Yui

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2013-4939 · Security Note
• https://moodle.org/mod/forum/discuss.php?d=232496 · Vendor Advisory
• http://yuilibrary.com/support/20130515-vulnerability · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mj87-8xf8-fp4w · Vendor Advisory
• https://lists.apache.org/thread.html/d8b9403dbab85a51255614949938b619bd03b1c944c76c48c6996a0e%40%3Cdev.zookeeper.apache.org%3E · Note
• https://lists.apache.org/thread.html/d8b9403dbab85a51255614949938b619bd03b1c944c76c48c6996a0e@%3Cdev.zookeeper.apache.org%3E · Note
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39678 · Note
• https://lists.apache.org/thread.html/72837f969cdf9b63a7e7337edd069fa3b3950eea7c997cc2ff61aa0c@%3Cissues.zookeeper.apache.org%3E · Note
• https://npmjs.com/advisories/332 · Note
• https://yuilibrary.com/support/20130515-vulnerability · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4939 · Note
• https://lists.apache.org/thread.html/72837f969cdf9b63a7e7337edd069fa3b3950eea7c997cc2ff61aa0c%40%3Cissues.zookeeper.apache.org%3E · Note