Описание
An issue was discovered in xdLocalStorage through 2.0.5. The postData() function in xdLocalStoragePostMessageApi.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the parent object. Therefore any domain can load the application hosting the "magical iframe" and receive the messages that the "magical iframe" sends.
Ссылки
- Product
- ExploitThird Party Advisory
- Product
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.0.5 (включая)
cpe:2.3:a:cross_domain_local_storage_project:cross_domain_local_storage:*:*:*:*:*:*:*:*
EPSS
Процентиль: 45%
0.00227
Низкий
8.8 High
CVSS3
6.8 Medium
CVSS2
Дефекты
CWE-668
Связанные уязвимости
EPSS
Процентиль: 45%
0.00227
Низкий
8.8 High
CVSS3
6.8 Medium
CVSS2
Дефекты
CWE-668