CVE-2010-4209 — Cross-site Scripting in YUI

CWE-79 — Cross-site Scripting5 documents5 sources

Severity

4.3MEDIUMNVD

EPSS

2.8%

top 13.95%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Yahoo YUI

Timeline

PublishedNov 7

Latest updateMay 17

Description

Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.8.1, as used in Bugzilla 3.7.1 through 3.7.3 and 4.1, allows remote attackers to inject arbitrary web script or HTML via vectors related to swfstore/swfstore.swf.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

▶NVDyahoo/yui2.8.0, 2.8.1+1

Patches

Patch: yuilibrary.com ↗Patch: yuilibrary.com ↗

🔴Vulnerability Details

GHSA

GHSA-pc4w-v257-3qm4: Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2↗2022-05-17

▶

OSV

CVE-2010-4209: Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2↗2010-11-07

▶

CVEList

CVE-2010-4209: Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2↗2010-11-07

▶

💬Community

Bugzilla

CVE-2010-4207 CVE-2010-4208 CVE-2010-4209 moodle: multiple vulnerabilities in embedded YUI (MSA-10-0017)↗2010-10-25

▶