CVE-2010-4208 — Cross-site Scripting in YUI

CWE-79 — Cross-site Scripting5 documents5 sources

Severity

4.3MEDIUMNVD

EPSS

2.5%

top 14.52%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Yahoo YUI

Timeline

PublishedNov 7

Latest updateMay 17

Description

Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.5.0 through 2.8.1, as used in Bugzilla, Moodle, and other products, allows remote attackers to inject arbitrary web script or HTML via vectors related to uploader/assets/uploader.swf.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

▶NVDyahoo/yui7 versions+6

Patches

Patch: yuilibrary.com ↗Patch: yuilibrary.com ↗

🔴Vulnerability Details

GHSA

GHSA-h289-v8rh-2wvj: Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2↗2022-05-17

▶

CVEList

CVE-2010-4208: Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2↗2010-11-07

▶

OSV

CVE-2010-4208: Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2↗2010-11-07

▶

💬Community

Bugzilla

CVE-2010-4207 CVE-2010-4208 CVE-2010-4209 moodle: multiple vulnerabilities in embedded YUI (MSA-10-0017)↗2010-10-25

▶