CVE-2013-4939
Cross-Site Scripting in yui
EPSS 1.5%
描述
Affected versions of `yui` are vulnerable to cross-site scripting in the `uploader.swf` and `io.swf` utilities, via script injection in the url. ## Recommendation YUI has published their recommendation to fix this issue. Their recommendation is to: - Delete self-hosted copies of these files if you are not using them - Use the Yahoo! CDN hosted files - Use the patched files provided on the YUI Library [here](https://yuilibrary.com/support/20130515-vulnerability/#resolution).
如何修補 CVE-2013-4939
要修補 CVE-2013-4939,請將受影響套件升級到下列已修補版本。
- npm/yui—升級至 3.10.3 或更新版本
CVE-2013-4939 正在被利用嗎?
低 — EPSS 為 1.5%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- from 0, < 3.10.3