| Vulnerability Name: | CVE-2010-4207 (CCN-62769) | ||||||||||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2010-10-25 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Published: | 2010-10-25 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Updated: | 2011-02-05 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Summary: | Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.8.1, as used in Bugzilla, Moodle, and other products, allows remote attackers to inject arbitrary web script or HTML via vectors related to charts/assets/charts.swf. | ||||||||||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
| ||||||||||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N) 3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
| ||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-79 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2010-4207 Source: FEDORA Type: UNKNOWN FEDORA-2010-17280 Source: FEDORA Type: UNKNOWN FEDORA-2010-17274 Source: FEDORA Type: UNKNOWN FEDORA-2010-17235 Source: SUSE Type: UNKNOWN SUSE-SR:2010:021 Source: CONFIRM Type: UNKNOWN http://moodle.org/mod/forum/discuss.php?d=160910 Source: CCN Type: SA41955 YUI Multiple Cross-Site Scripting Vulnerabilities Source: SECUNIA Type: Vendor Advisory 41955 Source: SECUNIA Type: UNKNOWN 42271 Source: CCN Type: SECTRACK ID: 1024683 Bugzilla Permits Cross-Site Scripting and HTTP Response Splitting Attacks and Discloses Certain Information to Remote Users Source: CONFIRM Type: UNKNOWN http://www.bugzilla.org/security/3.2.8/ Source: MLIST Type: UNKNOWN [oss-security] 20101107 Re: CVE request: moodle 1.9.10 Source: BUGTRAQ Type: UNKNOWN 20101103 Security Advisory for Bugzilla 3.2.8, 3.4.8, 3.6.2, and 3.7.3 Source: BID Type: UNKNOWN 44420 Source: CCN Type: BID-44420 YUI Multiple Cross Site Scripting Vulnerabilities Source: SECTRACK Type: UNKNOWN 1024683 Source: VUPEN Type: Vendor Advisory ADV-2010-2878 Source: VUPEN Type: UNKNOWN ADV-2010-2975 Source: CCN Type: YUI Library Web Site YUI 2.8.2 Security Bulletin: Addressing a Vulnerability in YUI 2.4.0 through YUI 2.8.1 Source: CONFIRM Type: Patch, Vendor Advisory http://yuilibrary.com/support/2.8.2/ Source: XF Type: UNKNOWN yui-charts-xss(62769) Source: CCN Type: IBM Security Bulletin 6252755 (License Metric Tool) Security vulnerabilities have been identified in BigFix Platform shipped with IBM License Metric Tool. Source: SUSE Type: SUSE-SR:2010:021 SUSE security summary report | ||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||||||||||