CVE-2013-4941
YUI Cross-site Scripting (XSS) vulnerability
CVE-2013-4941 is a medium vulnerability (CVSS 4.3) in Moodle, published July 26, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.19%, the 68th percentile. Fixed in moodle/moodle 2.2.11.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 1.19%EPSS, 68th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.2.11moodle/moodle +7 more
Description
Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 3.2.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
yuinpm | 3.2.0 to 3.9.1 | None known |
moodle/moodlePackagist | before 2.2.11 | 2.2.11 |
moodle/moodlePackagist | 2.3.0 up to 2.3.8 | 2.3.8 |
moodle/moodlePackagist | 2.4.0-rc1 up to 2.4.5 | 2.4.5 |
moodle/moodlePackagist | 2.5.0-beta up to 2.5.1 | 2.5.1 |
moodle/moodlePackagist | 2.3.0 up to 2.3.8, plus listed versions v2.3.4v2.3.5v2.3.6v2.3.7 | 2.3.8 |
moodle/moodlePackagist | 2.4.0-rc1 up to 2.4.5, plus listed versions v2.4.0v2.4.0-rc1v2.4.1v2.4.2v2.4.3v2.4.4 | 2.4.5 |
moodle/moodlePackagist | 2.5.0-beta up to 2.5.1, plus listed versions v2.5.0v2.5.0-betav2.5.0-rc1 | 2.5.1 |
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 3.2.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.
- Record
CVE-2013-4941- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 3.2.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.
- Record
CVE-2013-4941- Updated
- 2026-11-02
EUVDEUVD-2013-4785No score
Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 3.2.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.
- Record
EUVD-2013-4785- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-64r3-582j-frqm
YUI Cross-site Scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 3.2.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.
- Record
GHSA-64r3-582j-frqm- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-64r3-582j-frqm
YUI Cross-site Scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 3.2.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.
- Record
GHSA-64r3-582j-frqm- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
moodle.org/mod/forum/discuss.php?d=232496
git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39678
yuilibrary.com/support/20130515-vulnerability
nvd.nist.gov/vuln/detail/CVE-2013-4941
web.archive.org/web/20130909203912/http://yuilibrary.com/support/20130515-vulnerability
github.com/advisories/GHSA-64r3-582j-frqm