Vulnerability Name:

CVE-2010-4710 (CCN-65180)

Assigned:2010-05-21
Published:2010-05-21
Updated:2017-08-17
Summary:Cross-site scripting (XSS) vulnerability in the addItem method in the Menu widget in YUI before 2.9.0 allows remote attackers to inject arbitrary web script or HTML via a field that is added to a menu, related to documentation that specifies this field as a text field rather than an HTML field, a similar issue to CVE-2010-4569 and CVE-2010-4570.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.6 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:UR)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.6 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:UR)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2010-4710

Source: CCN
Type: SA43162
YUI Multiple Script Insertion Vulnerabilities

Source: CCN
Type: OSVDB ID: 70719
YUI Menu Widget addItem Method Menu Text-to-HTML Conversion XSS

Source: CCN
Type: YUI Library Web Site
YUI Library

Source: MISC
Type: UNKNOWN
http://yuilibrary.com/forum/viewtopic.php?p=12923

Source: CCN
Type: YUILibrary Web Site
doc: Default formatters in autocomplete allow for stored XSS

Source: MISC
Type: UNKNOWN
http://yuilibrary.com/projects/yui2/ticket/2529228

Source: CONFIRM
Type: UNKNOWN
http://yuilibrary.com/projects/yui2/ticket/2529231

Source: XF
Type: UNKNOWN
yui-additem-xss(65180)

Source: XF
Type: UNKNOWN
yui-additem-xss(65180)

Source: CCN
Type: IBM Security Bulletin 6252755 (License Metric Tool)
Security vulnerabilities have been identified in BigFix Platform shipped with IBM License Metric Tool.

Source: CCN
Type: IBM Security Bulletin 6344075 (QRadar SIEM)
IBM QRadar SIEM is vulnerable to Using Components with Known Vulnerabilities

Vulnerable Configuration:Configuration 1:
  • cpe:/a:yahoo:yui:2.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:yahoo:yui:2.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:yahoo:yui:2.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:yahoo:yui:2.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:yahoo:yui:2.4.0:*:*:*:*:*:*:*
  • OR cpe:/a:yahoo:yui:2.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:yahoo:yui:2.5.0:*:*:*:*:*:*:*
  • OR cpe:/a:yahoo:yui:2.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:yahoo:yui:2.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:yahoo:yui:2.6.0:*:*:*:*:*:*:*
  • OR cpe:/a:yahoo:yui:2.7.0:*:*:*:*:*:*:*
  • OR cpe:/a:yahoo:yui:2.8.0:*:*:*:*:*:*:*
  • OR cpe:/a:yahoo:yui:2.8.1:*:*:*:*:*:*:*
  • OR cpe:/a:yahoo:yui:2.8.1:pr1:*:*:*:*:*:*
  • OR cpe:/a:yahoo:yui:*:*:*:*:*:*:*:* (Version <= 2.8.2)

    • Configuration CCN 1:
  • cpe:/a:ibm:license_metric_tool:9.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.4.0:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.4.1:-:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    yahoo yui 2.2.0
    yahoo yui 2.2.2
    yahoo yui 2.3.0
    yahoo yui 2.3.1
    yahoo yui 2.4.0
    yahoo yui 2.4.1
    yahoo yui 2.5.0
    yahoo yui 2.5.1
    yahoo yui 2.5.2
    yahoo yui 2.6.0
    yahoo yui 2.7.0
    yahoo yui 2.8.0
    yahoo yui 2.8.1
    yahoo yui 2.8.1 pr1
    yahoo yui *
    ibm license metric tool 9.2
    ibm qradar security information and event manager 7.3.0
    ibm qradar security information and event manager 7.4.0
    ibm qradar security information and event manager 7.4.1 -