CVE-2013-4939
Cross-Site Scripting in yui
EPSS 0.31%
Description
Affected versions of `yui` are vulnerable to cross-site scripting in the `uploader.swf` and `io.swf` utilities, via script injection in the url. ## Recommendation YUI has published their recommendation to fix this issue. Their recommendation is to: - Delete self-hosted copies of these files if you are not using them - Use the Yahoo! CDN hosted files - Use the patched files provided on the YUI Library [here](https://yuilibrary.com/support/20130515-vulnerability/#resolution).
How to fix CVE-2013-4939
To remediate CVE-2013-4939, upgrade the affected package to a fixed version below.
- —upgrade to 3.10.3 or later
Is CVE-2013-4939 being exploited?
Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 3.10.3