Description
Cross-site scripting (XSS) vulnerability in flashuploader.swf in the Uploader component in Yahoo! YUI 3.5.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.
Remediation
References
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39678
http://yuilibrary.com/support/20130515-vulnerability/
https://moodle.org/mod/forum/discuss.php?d=232496
Related Vulnerabilities
CVE-2022-0355 Vulnerability in npm package simple-get
CVE-2013-7370 Vulnerability in npm package connect
CVE-2021-32643 Vulnerability in maven package org.http4s:http4s-core
CVE-2020-36649 Vulnerability in maven package org.webjars.npm:papaparse
CVE-2022-0084 Vulnerability in maven package org.jboss.xnio:xnio-api