CVE-2013-4939
Cross-Site Scripting in yui
Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.0.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.0.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.
- Record
CVE-2013-4939- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.0.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.
- Record
CVE-2013-4939- Updated
- 2026-11-02
EUVDEUVD-2020-1179 No score
Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.0.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.
- Record
EUVD-2020-1179- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mj87-8xf8-fp4w No score
Cross-Site Scripting in yui
Affected versions of yui are vulnerable to cross-site scripting in the uploader.swf and io.swf utilities, via script injection in the url.
Recommendation
YUI has published their recommendation to fix this issue. Their recommendation is to:
- Delete self-hosted copies of these files if you are not using them
- Use the Yahoo! CDN hosted files
- Use the patched files provided on the YUI Library here.
- Record
GHSA-mj87-8xf8-fp4w- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-mj87-8xf8-fp4w No score
Cross-Site Scripting in yui
Affected versions of yui are vulnerable to cross-site scripting in the uploader.swf and io.swf utilities, via script injection in the url.
Recommendation
YUI has published their recommendation to fix this issue. Their recommendation is to:
- Delete self-hosted copies of these files if you are not using them
- Use the Yahoo! CDN hosted files
- Use the patched files provided on the YUI Library here.
- Record
GHSA-mj87-8xf8-fp4w- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4939 is a medium vulnerability (CVSS 4.3) in Moodle, published July 26, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.49%, the 74th percentile. Fixed in yui 3.10.2.
References
moodle.org/mod/forum/discuss.php?d=232496
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39678
yuilibrary.com/support/20130515-vulnerability
lists.apache.org/thread.html/d8b9403dbab85a51255614949938b619bd03b1c944c76c48c6996a0e%40%3Cdev.zookeeper.apache.org%3E
npmjs.com/advisories/332
Show 4 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-4939
github.com/advisories/GHSA-mj87-8xf8-fp4w