GitHub Advisoryadvisory · npm

GHSA-c6c4-jmqx-3r33 Open Redirect in xdLocalStorage

MEDIUM Published 2021-12-09 Modified 2021-05-25 Official page ↗
Aliases
CVE-2020-11611
Ecosystem
npm
Packages
xdlocalstorage
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2021-05-25

Affected packages

• npm xdlocalstorage: <= 2.0.5 (no fix yet)

Description

An issue was discovered in xdLocalStorage through 2.0.5. The buildMessage() function in xdLocalStorage.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the iframe object. Therefore any domain that is currently loaded within the iframe can receive the messages that the client sends.

Related

Alias · CVE (1)

  • CVE-2020-11611 An issue was discovered in xdLocalStorage through 2.0.5. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References