CVEvulnerability

CVE-2020-11611

6.1 MEDIUM Published 2020-04-07 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-04-07
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
Weaknesses
CWE-601

Description

An issue was discovered in xdLocalStorage through 2.0.5. The buildMessage() function in xdLocalStorage.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the iframe object. Therefore any domain that is currently loaded within the iframe can receive the messages that the client sends.

Affected configurations

• cross domain local storage project cross domain local storage (<= 2.0.5)

Related

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References