CVE-2020-11611

2020-04-0717:18:54

mitre

www.cve.org

0.001 Low

EPSS

Percentile

32.7%

JSON

An issue was discovered in xdLocalStorage through 2.0.5. The buildMessage() function in xdLocalStorage.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the iframe object. Therefore any domain that is currently loaded within the iframe can receive the messages that the client sends.