GHSA-vrc7-6g8w-jh56

    Dashboard / Vulnerabilities / GHSA-vrc7-6g8w-jh56

    GHSA-vrc7-6g8w-jh56

    Published: 9 Dec 2021Last Modified: 8 Nov 2023
    Aliases:
    CVE-2015-9544

    Summary: Improper Input Validation in xdLocalStorage

    Details: An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStoragePostMessageApi.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the confidentiality and integrity of data in the local storage of the vulnerable site via malicious web messages.

    References: https://nvd.nist.gov/vuln/detail/CVE-2015-9544, https://github.com/ofirdagan/cross-domain-local-storage/issues/17, https://github.com/ofirdagan/cross-domain-local-storage/pull/19, https://github.com/ofirdagan/cross-domain-local-storage, https://grimhacker.com/exploiting-xdlocalstorage-localstorage-and-postmessage/#Missing-Origin-Magic-iframe

    Affected packages

    Package

    Name: xdlocalstorage

    Purl: pkg:npm/xdlocalstorage

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-vrc7-6g8w-jh56 | CVE-DB