YUI CVE-2013-4939 Cross-Site Scripting Vulnerability

Bugtraq ID:	61527
Class:	Input Validation Error
CVE:	CVE-2013-4939
Remote:	Yes
Local:	No
Published:	Jul 15 2013 12:00AM
Updated:	Jul 15 2013 12:00AM
Credit:	Aleksandr Dobkin and Sebastian Roschke of the Google Security Team.
Vulnerable:	Moodle Moodle 2.4.4 Moodle Moodle 2.4.3 Moodle Moodle 2.3.7 Moodle Moodle 2.3.6 Moodle Moodle 2.3.3 Moodle Moodle 2.3.2 Moodle Moodle 2.3.1 Moodle Moodle 2.2.10 Moodle Moodle 2.2.9 Moodle Moodle 2.2.6 Moodle Moodle 2.2.5 Moodle Moodle 2.2.4 Moodle Moodle 2.2.3 Moodle Moodle 2.2.2 Moodle Moodle 2.2.1 Moodle Moodle 2.5 Moodle Moodle 2.4.2 Moodle Moodle 2.4.1 Moodle Moodle 2.4 Moodle Moodle 2.3.5 Moodle Moodle 2.3.4 Moodle Moodle 2.3 Moodle Moodle 2.2.8 Moodle Moodle 2.2.7 Moodle Moodle 2.2
Not Vulnerable:	Moodle Moodle 2.5.1 Moodle Moodle 2.4.5 Moodle Moodle 2.3.8 Moodle Moodle 2.2.11

YUI CVE-2013-4939 Cross-Site Scripting Vulnerability

YUI is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Note: This issue was previously covered in BID 61177 (YUI Multiple Cross-Site Scripting Vulnerabilities), but has been moved to its own record for better documentation.

YUI 3.0.0 through version 3.9.1 are vulnerable.

YUI CVE-2013-4939 Cross-Site Scripting Vulnerability

To exploit this issue an attacker must entice an unsuspecting victim to follow a malicious URI.