GitHub Advisoryadvisory · npm

GHSA-mr5m-2385-2vcp xdlocalstorage does not verify request origin

HIGH Published 2022-05-24 Modified 2023-07-17 Official page ↗
Aliases
CVE-2020-11610
Ecosystem
npm
Packages
xdlocalstorage
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-668
Reviewed
2023-07-17

Affected packages

• npm xdlocalstorage: <= 2.0.5 (no fix yet)

Description

An issue was discovered in xdLocalStorage through 2.0.5. The `postData()` function in `xdLocalStoragePostMessageApi.js` specifies the wildcard (`*`) as the targetOrigin when calling the `postMessage()` function on the parent object. Therefore any domain can load the application hosting the "magical iframe" and receive the messages that the "magical iframe" sends.

Related

Alias · CVE (1)

  • CVE-2020-11610 An issue was discovered in xdLocalStorage through 2.0.5. vulnerability

Weakness · CWE (1)

  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References