← Back to CVE List

CVE-2020-11611

Published: 2020-04-07T18:15Z
Last Modified: 2024-11-21T04:58Z
Source: MITRE CVE List
License: MITRE-CVE-TOS
An issue was discovered in xdLocalStorage through 2.0.5. The buildMessage() function in xdLocalStorage.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the iframe object. Therefore any domain that is currently loaded within the iframe can receive the messages that the client sends. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt