CVE-2013-4940

Moodle 2.1.10 2.2.x<2.2.11 2.3.x<2.3.8 2.4.x<2.4.5 2.5.x<2.5.1 - Cross-Site Scripting via Yahoo YUI IO Utility

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL. NOTE: this vulnerability exists because of a CVE-2013-4939 regression.

References (3)

Core 3
Core References
Vendor Advisory x_refsource_confirm
https://moodle.org/mod/forum/discuss.php?d=232496
Patch, Vendor Advisory x_refsource_confirm
http://yuilibrary.com/support/20130515-vulnerability/

Scores

EPSS 0.0034
EPSS Percentile 57.1%

Details

CWE
CWE-79
Status published
Products (50)
moodle/moodle 2.1.0
moodle/moodle 2.1.1
moodle/moodle 2.1.2
moodle/moodle 2.1.3
moodle/moodle 2.1.4
moodle/moodle 2.1.5
moodle/moodle 2.1.6
moodle/moodle 2.1.7
moodle/moodle 2.1.8
moodle/moodle 2.1.9
... and 40 more
Published Jul 29, 2013
Tracked Since Feb 18, 2026