Miggo Logo
Miggo Vulnerability Database
→
CVE-2012-5881

CVE-2012-5881: Cross-site scripting in yui 2.4.0

4.3

CVSS Score

Basic Information

CVE ID
CVE-2012-5881
GHSA ID
GHSA-jjg9-mf63-vqrp
EPSS Score
0.54931%
CWE
CWE-79
Published
5/17/2022
Updated
1/9/2024
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
AV:N/AC:M/Au:N/C:N/I:P/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
yui2npm>= 2.4.0, <= 2.9.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from insecure Flash components (charts.swf and others) that allow XSS through improper input handling. However:

  1. The advisory specifically references compiled SWF files rather than JavaScript/TypeScript source code
  2. No actual function names or source code patches are disclosed in the provided materials
  3. SWF files are binary artifacts where function names would require decompilation to identify
  4. The YUI security bulletin focuses on file replacement rather than code changes Without access to the original ActionScript source code or decompiled SWF analysis, we cannot confidently name specific vulnerable functions - only identify the vulnerable Flash components at the file level.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*ross-sit* s*riptin* (XSS) vuln*r**ility in t** *l*s* *ompon*nt in*r*stru*tur* in YUI *.*.* t*rou** *.*.* *llows r*mot* *tt**k*rs to inj**t *r*itr*ry w** s*ript or *TML vi* v**tors r*l*t** to ***rts.sw*, * simil*r issu* to *V*-****-****.

Reasoning

T** vuln*r**ility st*ms *rom ins**ur* *l*s* *ompon*nts (***rts.sw* *n* ot**rs) t**t *llow XSS t*rou** improp*r input **n*lin*. *ow*v*r: *. T** **visory sp**i*i**lly r***r*n**s *ompil** SW* *il*s r*t**r t**n J*v*S*ript/Typ*S*ript sour** *o** *. No **t