# CVE-2013-4942: Yahoo YUI flashuploader.swf cross-site scripting

Source: https://junglewise.ai/threats/cve-2013-4942-yahoo-yui-flashuploader-swf-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2013-4942 · Severity: medium · CVSS 4 · Published 2022-05-13

Yahoo's YUI library includes a Flash-based file uploader component that is vulnerable to cross-site scripting (XSS) attacks. An attacker can craft a malicious URL that injects arbitrary JavaScript code into a web page, allowing them to steal user sessions, steal credentials, deface content, or perform actions on behalf of the victim.

Technologies: [Moodle](https://junglewise.ai/threats/technologies/moodle). Vendors: [Moodle](https://junglewise.ai/threats/vendors/moodle).

## Quick answers

**Is CVE-2013-4942 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2013-4942 being exploited in the wild.

**How severe is CVE-2013-4942?** Medium severity, with a CVSS score of 4, published 13 May 2022.

**Which products and versions are affected?** Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1.

**Is there a fix for CVE-2013-4942?** A patch was published on 2013: Patches released for affected Moodle versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2013-4942 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2013-4942?** Check whether you run Moodle at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A cross-site scripting (CWE-79) vulnerability exists in the flashuploader.swf component of Yahoo's YUI library versions 3.2.0 through 3.9.1. The vulnerability is triggered by improper handling of crafted URL parameters passed to the Flash uploader, allowing injection of arbitrary web script or HTML. The attack requires user interaction (clicking a malicious link) but no authentication. An attacker can exploit this by crafting a URL containing XSS payload that will execute in the context of the victim's browser session. Patches are available in YUI versions after 3.9.1 and Moodle versions 2.2.11, 2.3.8, 2.4.5, and 2.5.1.

## Affected products

- Yahoo YUI 3.2.0 through 3.9.1
- Moodle Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1

## Identifiers

- CVE-2013-4942
- GHSA-9ww8-j8j2-3788

## Timeline

- 2013-07-29: disclosed: Vulnerability disclosed to NVD
- 2013: patched: Patches released for affected Moodle versions
- 2022-05-13: advisory: GHSA advisory published

## References

- [https://moodle.org/mod/forum/discuss.php?d=232496](https://moodle.org/mod/forum/discuss.php?d=232496)

## Related threats

- [Moodle insufficient access control in H5P content files](https://junglewise.ai/threats/cve-2026-123655-a-flaw-was-found-in-moodle-insufficient-access-control-checks-on)
- [Moodle missing capability check in core_grades_get_gradeitems](https://junglewise.ai/threats/cve-2026-119556-moodle-4-2-0-through-4-5-15-5-0-0-through-5-0-11-5-1-0-through-5)
- [Moodle core_grades_get_feedback information disclosure](https://junglewise.ai/threats/cve-2026-119555-moodle-4-2-0-through-4-5-15-5-0-0-through-5-0-11-5-1-0-through-5)
- [Moodle SQL injection in External database enrolment plugin](https://junglewise.ai/threats/cve-2026-119554-moodle-5-3-0-5-2-0-through-5-2-4-5-1-0-through-5-1-8-5-0-0)
- [Moodle path traversal in Blackboard question import](https://junglewise.ai/threats/cve-2026-119553-moodle-5-3-0-5-2-0-through-5-2-4-5-1-0-through-5-1-8-5-0-0)