GHSA-c6c4-jmqx-3r33

Source

https://github.com/advisories/GHSA-c6c4-jmqx-3r33

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-c6c4-jmqx-3r33/GHSA-c6c4-jmqx-3r33.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-c6c4-jmqx-3r33

Aliases

CVE-2020-11611

Published

2021-12-09T19:30:14Z

Modified

2023-11-08T04:02:06Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Open Redirect in xdLocalStorage

Details

An issue was discovered in xdLocalStorage through 2.0.5. The buildMessage() function in xdLocalStorage.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the iframe object. Therefore any domain that is currently loaded within the iframe can receive the messages that the client sends.

Database specific

{
    "cwe_ids":  [
        "CWE-601"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2021-05-25T16:23:58Z",
    "nvd_published_at":  "2020-04-07T18:15:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / xdlocalstorage

Package

Name: xdlocalstorage; View open source insights on deps.dev
Purl: pkg:npm/xdlocalstorage

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

2.0.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-c6c4-jmqx-3r33/GHSA-c6c4-jmqx-3r33.json"