CVE-2013-4939
Moodle 2.1.10 2.2.x<2.2.11 2.3.x<2.3.8 2.4.x<2.4.5 2.5.x<2.5.1 - Cross-Site Scripting via IO Utility Component
Title source: llmDescription
Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.0.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.
References (5)
Core 5
Core References
Vendor Advisory x_refsource_confirm
https://moodle.org/mod/forum/discuss.php?d=232496
Patch x_refsource_confirm
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39678
Patch, Vendor Advisory x_refsource_confirm
http://yuilibrary.com/support/20130515-vulnerability/
Mailing List mailing-list
x_refsource_mlist
https://lists.apache.org/thread.html/d8b9403dbab85a51255614949938b619bd03b1c944c76c48c6996a0e%40%3Cdev.zookeeper.apache.org%3E
Mailing List mailing-list
x_refsource_mlist
https://lists.apache.org/thread.html/72837f969cdf9b63a7e7337edd069fa3b3950eea7c997cc2ff61aa0c%40%3Cissues.zookeeper.apache.org%3E
Scores
EPSS
0.0031
EPSS Percentile
54.3%
Details
CWE
CWE-79
Status
published
Products (50)
moodle/moodle
2.1.0
moodle/moodle
2.1.1
moodle/moodle
2.1.2
moodle/moodle
2.1.3
moodle/moodle
2.1.4
moodle/moodle
2.1.5
moodle/moodle
2.1.6
moodle/moodle
2.1.7
moodle/moodle
2.1.8
moodle/moodle
2.1.9
... and 40 more
Published
Jul 29, 2013
Tracked Since
Feb 18, 2026