Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.0.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.0.0 through
    3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5,
    2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via
    a crafted string in a URL. (CVE-2013-4939)

According to its self-reported version number, YUI is at least 3.0.0 and prior to 3.10.1 or 3.10.2. Therefore, it may be affected by a cross-site scripting vulnerability via YUI io.swf file.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
416997	SCA: security update for yui (GHSA-mj87-8xf8-fp4w)	Tenable Cloud Security	SCA Checks	medium
416997	SCA: security update for yui (GHSA-mj87-8xf8-fp4w)	Tenable Self-Hosted Container Security	SCA Checks	medium
112417	YUI 3.10.2 Cross-site Scripting	Web App Scanning	Component Vulnerability	medium
112416	YUI 3.0.0 < 3.10.1 Cross-site Scripting	Web App Scanning	Component Vulnerability	medium

Detections

Analytics

CVE-2013-4939

medium

Tenable Plugins

medium

medium

medium

medium