Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL. NOTE: this vulnerability exists because of a CVE-2013-4939 regression.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as
    used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before
    2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted
    string in a URL. NOTE: this vulnerability exists because of a CVE-2013-4939 regression. (CVE-2013-4940)

According to its self-reported version number, YUI is at least 3.0.0 and prior to 3.10.1 or 3.10.2. Therefore, it may be affected by a cross-site scripting vulnerability via YUI io.swf file.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
433824	SCA: security update for moodle/moodle, yui (GHSA-x5hj-47vv-53p8)	Tenable Cloud Security	SCA Checks	Local	medium
433824	SCA: security update for moodle/moodle, yui (GHSA-x5hj-47vv-53p8)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
112417	YUI 3.10.2 Cross-site Scripting	Web App Scanning	Component Vulnerability	Version Based	medium
112416	YUI 3.0.0 < 3.10.1 Cross-site Scripting	Web App Scanning	Component Vulnerability	Version Based	medium

Detections

Analytics

CVE-2013-4940

medium

Tenable Plugins

medium

medium

medium

medium