From e00a7303bc09eb6a5ac9e63747ca148235a53ead Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Sat, 12 Apr 2025 03:29:09 +0000
Subject: [PATCH] Publish Advisories

GHSA-9ww8-j8j2-3788
GHSA-9ww8-j8j2-3788
---
 .../GHSA-9ww8-j8j2-3788.json                  | 141 ++++++++++++++++++
 .../GHSA-9ww8-j8j2-3788.json                  |  39 -----
 2 files changed, 141 insertions(+), 39 deletions(-)
 create mode 100644 advisories/github-reviewed/2022/05/GHSA-9ww8-j8j2-3788/GHSA-9ww8-j8j2-3788.json
 delete mode 100644 advisories/unreviewed/2022/05/GHSA-9ww8-j8j2-3788/GHSA-9ww8-j8j2-3788.json

diff --git a/advisories/github-reviewed/2022/05/GHSA-9ww8-j8j2-3788/GHSA-9ww8-j8j2-3788.json b/advisories/github-reviewed/2022/05/GHSA-9ww8-j8j2-3788/GHSA-9ww8-j8j2-3788.json
new file mode 100644
index 00000000000..8b1b0b79da9
--- /dev/null
+++ b/advisories/github-reviewed/2022/05/GHSA-9ww8-j8j2-3788/GHSA-9ww8-j8j2-3788.json
@@ -0,0 +1,141 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-9ww8-j8j2-3788",
+  "modified": "2025-04-12T03:26:53Z",
+  "published": "2022-05-13T01:12:55Z",
+  "aliases": [
+    "CVE-2013-4942"
+  ],
+  "summary": "YUI Cross-site Scripting (XSS) vulnerability",
+  "details": "Cross-site scripting (XSS) vulnerability in flashuploader.swf in the Uploader component in Yahoo! YUI 3.5.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "yui"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.2.0"
+            },
+            {
+              "last_affected": "3.9.1"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "moodle/moodle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.2.11"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "moodle/moodle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.3.0"
+            },
+            {
+              "fixed": "2.3.8"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "moodle/moodle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.4.0-rc1"
+            },
+            {
+              "fixed": "2.4.5"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "moodle/moodle"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.5.0-beta"
+            },
+            {
+              "fixed": "2.5.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4942"
+    },
+    {
+      "type": "WEB",
+      "url": "https://moodle.org/mod/forum/discuss.php?d=232496"
+    },
+    {
+      "type": "WEB",
+      "url": "https://web.archive.org/web/20130909203912/http://yuilibrary.com/support/20130515-vulnerability"
+    },
+    {
+      "type": "WEB",
+      "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39678"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-04-12T03:26:53Z",
+    "nvd_published_at": "2013-07-29T13:59:00Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2022/05/GHSA-9ww8-j8j2-3788/GHSA-9ww8-j8j2-3788.json b/advisories/unreviewed/2022/05/GHSA-9ww8-j8j2-3788/GHSA-9ww8-j8j2-3788.json
deleted file mode 100644
index 1cd0d2041b2..00000000000
--- a/advisories/unreviewed/2022/05/GHSA-9ww8-j8j2-3788/GHSA-9ww8-j8j2-3788.json
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-9ww8-j8j2-3788",
-  "modified": "2025-04-11T04:12:21Z",
-  "published": "2022-05-13T01:12:55Z",
-  "aliases": [
-    "CVE-2013-4942"
-  ],
-  "details": "Cross-site scripting (XSS) vulnerability in flashuploader.swf in the Uploader component in Yahoo! YUI 3.5.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.",
-  "severity": [],
-  "affected": [],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4942"
-    },
-    {
-      "type": "WEB",
-      "url": "https://moodle.org/mod/forum/discuss.php?d=232496"
-    },
-    {
-      "type": "WEB",
-      "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39678"
-    },
-    {
-      "type": "WEB",
-      "url": "http://yuilibrary.com/support/20130515-vulnerability"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-79"
-    ],
-    "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2013-07-29T13:59:00Z"
-  }
-}
\ No newline at end of file