CVE-2013-4942: YUI Cross-site Scripting (XSS) Vulnerability in Moodle and YUI
Summary
CVE-2013-4942: YUI Cross-site Scripting (XSS) vulnerability. Affects yui versions >= 3.2.0, <= 3.9.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yahoo! YUI (Yahoo User Interface Library) is a set of utilities and controls for building richly interactive web applications. The library provides a variety of components, including the Uploader component, which allows users to upload files. This library has been integrated into various platforms, including Moodle, a widely-used open-source learning management system. The vulnerability in question affects versions of YUI from 3.5.0 to 3.9.1 and specific versions of Moodle, making it susceptible to cross-site scripting attacks.
Vulnerability Detail
The vulnerability arises from a cross-site scripting (XSS) flaw in the flashuploader.swf file within the Uploader component of YUI. This flaw allows remote attackers to inject arbitrary web scripts or HTML into web pages viewed by users. The issue is particularly concerning as it can lead to unauthorized actions being performed on behalf of users, potentially compromising sensitive information and user accounts.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not possible, consider disabling the Uploader component or restricting access to it until a patch can be applied. Additionally, implement Content Security Policy (CSP) headers to mitigate the risk of XSS attacks.
Conclusion
The CVE-2013-4942 vulnerability in YUI and Moodle poses a significant risk due to its potential for cross-site scripting attacks. Updating to the latest versions of the affected packages is crucial for maintaining security. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for yui →
FAQ
The vulnerability is a cross-site scripting (XSS) flaw that allows attackers to inject malicious scripts into web pages.
YUI versions from 3.5.0 to 3.9.1 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
If exploited, this vulnerability can lead to unauthorized actions on behalf of users, data theft, and compromised user accounts.
Yes, you can implement Content Security Policy (CSP) headers and disable the Uploader component as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for yui.
