Executive brief
YUI is a popular JavaScript library used to build web applications. The Uploader component in YUI versions 3.2.0 through 3.9.1 contains a cross-site scripting (XSS) vulnerability in its Flash component (uploader.swf) that allows attackers to inject malicious scripts into web pages viewed by users. This vulnerability could be exploited to steal user credentials, session data, or perform actions on behalf of users visiting affected pages.
Technical details
A cross-site scripting (CWE-79) vulnerability exists in the uploader.swf Flash component of Yahoo! YUI's Uploader module (versions 3.2.0 through 3.9.1). The vulnerability is triggered when a crafted URL containing arbitrary JavaScript is passed to the component, which fails to properly sanitize or validate the input before rendering it. The attack is network-accessible and requires user interaction (a user must click or interact with the affected uploader component). Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking or data theft. Patches are available in YUI 3.9.2 and later.
Affected products
- Yahoo YUI 3.2.0 through 3.9.1
- Moodle Moodle 2.1.10 through 2.5.0
Timeline
- 2013-07-29: disclosed: Vulnerability disclosed to NVD
- 2022-05-13: advisory: GitHub Security Advisory GHSA-64r3-582j-frqm published