Description

Cross-site scripting (XSS) vulnerability in flashuploader.swf in the Uploader component in Yahoo! YUI 3.5.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.

Remediation

References

https://moodle.org/mod/forum/discuss.php?d=232496

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39678

http://yuilibrary.com/support/20130515-vulnerability/

Related Vulnerabilities

CVE-2015-5167 Vulnerability in maven package org.apache.ranger:ranger

CVE-2023-50730 Vulnerability in maven package edu.gemini:gsp-graphql-core_native0.4_3

CVE-2019-10212 Vulnerability in maven package io.undertow:undertow-core

CVE-2021-36738 Vulnerability in maven package org.apache.portals.pluto.demo:applicant-mvcbean-cdi-jsp-portlet

CVE-2020-24590 Vulnerability in maven package org.wso2.carbon.governance:org.wso2.carbon.governance.generic

Severity

Critical

Classification

CWE-79

Tags

Vendor Advisory Patch