CVE-2013-4942

Moodle 2.1.10 2.2.x<2.2.11 2.3.x<2.3.8 2.4.x<2.4.5 2.5.x<2.5.1 - Cross-Site Scripting via Yahoo YUI Flash Uploader

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in flashuploader.swf in the Uploader component in Yahoo! YUI 3.5.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.

References (3)

Core 3
Core References
Vendor Advisory x_refsource_confirm
https://moodle.org/mod/forum/discuss.php?d=232496
Patch, Vendor Advisory x_refsource_confirm
http://yuilibrary.com/support/20130515-vulnerability/

Scores

EPSS 0.0032
EPSS Percentile 55.3%

Details

CWE
CWE-79
Status published
Products (50)
moodle/moodle 2.1.0
moodle/moodle 2.1.1
moodle/moodle 2.1.2
moodle/moodle 2.1.3
moodle/moodle 2.1.4
moodle/moodle 2.1.5
moodle/moodle 2.1.6
moodle/moodle 2.1.7
moodle/moodle 2.1.8
moodle/moodle 2.1.9
... and 40 more
Published Jul 29, 2013
Tracked Since Feb 18, 2026