GHSA-x5hj-47vv-53p8

Suggest an improvement
Source
https://github.com/advisories/GHSA-x5hj-47vv-53p8
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-x5hj-47vv-53p8/GHSA-x5hj-47vv-53p8.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-x5hj-47vv-53p8
Aliases
  • CVE-2013-4940
Published
2022-05-13T01:12:54Z
Modified
2025-04-12T04:12:08Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
YUI Cross-site Scripting (XSS) vulnerability
Details

Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL. NOTE: this vulnerability exists because of a CVE-2013-4939 regression.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-12T03:24:28Z",
    "nvd_published_at": "2013-07-29T13:59:00Z",
    "severity": "MODERATE"
}
References

Affected packages

npm
yui

Package

Name
yui
View open source insights on deps.dev
Purl
pkg:npm/yui

Affected ranges

Type
SEMVER
Events
Introduced
3.0.0
Fixed
3.10.11

Database specific

last_known_affected_version_range 
"<= 3.10.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-x5hj-47vv-53p8/GHSA-x5hj-47vv-53p8.json"
yui

Package

Name
yui
View open source insights on deps.dev
Purl
pkg:npm/yui

Affected ranges

Type
SEMVER
Events
Introduced
3.10.12
Fixed
3.10.13

Affected versions

3.*
3.10.12

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-x5hj-47vv-53p8/GHSA-x5hj-47vv-53p8.json"
Packagist
moodle/moodle

Package

Name
moodle/moodle
Purl
pkg:composer/moodle/moodle

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.2.11

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-x5hj-47vv-53p8/GHSA-x5hj-47vv-53p8.json"
moodle/moodle

Package

Name
moodle/moodle
Purl
pkg:composer/moodle/moodle

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.3.0
Fixed
2.3.8

Affected versions

v2.*
v2.3.4
v2.3.5
v2.3.6
v2.3.7

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-x5hj-47vv-53p8/GHSA-x5hj-47vv-53p8.json"
moodle/moodle

Package

Name
moodle/moodle
Purl
pkg:composer/moodle/moodle

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.4.0-rc1
Fixed
2.4.5

Affected versions

v2.*
v2.4.0-rc1
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-x5hj-47vv-53p8/GHSA-x5hj-47vv-53p8.json"
moodle/moodle

Package

Name
moodle/moodle
Purl
pkg:composer/moodle/moodle

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.5.0-beta
Fixed
2.5.1

Affected versions

v2.*
v2.5.0-beta
v2.5.0-rc1
v2.5.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-x5hj-47vv-53p8/GHSA-x5hj-47vv-53p8.json"