Lucene search
GoogleOSV:GHSA-MR5M-2385-2VCPHistoryMay 24, 2022 - 5:13 p.m.
xdlocalstorage does not verify request origin
2022-05-2417:13:39
Google
osv.dev
4
0.002 Low
EPSS
Percentile
61.2%
An issue was discovered in xdLocalStorage through 2.0.5. The postData() function in xdLocalStoragePostMessageApi.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the parent object. Therefore any domain can load the application hosting the “magical iframe” and receive the messages that the “magical iframe” sends.
| CPE | Name | Operator | Version |
|---|---|---|---|
| xdlocalstorage | le | 2.0.5 |
References
github.com/ofirdagan/cross-domain-local-storage
github.com/ofirdagan/cross-domain-local-storage/issues/17
github.com/ofirdagan/cross-domain-local-storage/pull/19
grimhacker.com/exploiting-xdlocalstorage-localstorage-and-postmessage/#Missing-TargetOrigin-Magic-iframe
nvd.nist.gov/vuln/detail/CVE-2020-11610
Related
github
github
xdlocalstorage does not verify request origin
2022-05-24 17:13:39
prion
prion
Design/Logic Flaw
2020-04-07 18:15:00
osv
osv
CVE-2020-11610
2020-04-07 18:15:13
nvd
nvd
CVE-2020-11610
2020-04-07 18:15:13
cvelist
cvelist
CVE-2020-11610
2020-04-07 17:19:06
cve
cve
CVE-2020-11610
2020-04-07 18:15:13