CVE-2020-11610

2020-04-0718:15:13

Google

osv.dev

6.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.2%

JSON

An issue was discovered in xdLocalStorage through 2.0.5. The postData() function in xdLocalStoragePostMessageApi.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the parent object. Therefore any domain can load the application hosting the “magical iframe” and receive the messages that the “magical iframe” sends.

CPENameOperatorVersion
cross-domain-local-storageeq1.0.12
cross-domain-local-storageeq1.0.3
cross-domain-local-storageeq2.0.1
cross-domain-local-storageeq2.0.4
cross-domain-local-storageeq1.0.4
cross-domain-local-storageeq2.0.2
cross-domain-local-storageeq2.0.5
cross-domain-local-storageeq1.0.6
cross-domain-local-storageeq1.0.1
cross-domain-local-storageeq1.0.2

Name	Operator	Version
cross-domain-local-storage	eq	1.0.12
cross-domain-local-storage	eq	1.0.3
cross-domain-local-storage	eq	2.0.1
cross-domain-local-storage	eq	2.0.4
cross-domain-local-storage	eq	1.0.4
cross-domain-local-storage	eq	2.0.2
cross-domain-local-storage	eq	2.0.5
cross-domain-local-storage	eq	1.0.6
cross-domain-local-storage	eq	1.0.1
cross-domain-local-storage	eq	1.0.2