What’s Vulnerable › Vulnerabilities

CVE-2020-11610

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-04-07 · updated 2026-06-17
• Weakness: CWE-668

Description

An issue was discovered in xdLocalStorage through 2.0.5. The postData() function in xdLocalStoragePostMessageApi.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the parent object. Therefore any domain can load the application hosting the "magical iframe" and receive the messages that the "magical iframe" sends.

Affected products

• Cross Domain Local Storage Project Cross Domain Local Storage: through 2.0.5

References

• https://github.com/ofirdagan/cross-domain-local-storage
• https://grimhacker.com/exploiting-xdlocalstorage-localstorage-and-postmessage/#Missing-TargetOrigin-Magic-iframe
• https://github.com/ofirdagan/cross-domain-local-storage
• https://grimhacker.com/exploiting-xdlocalstorage-localstorage-and-postmessage/#Missing-TargetOrigin-Magic-iframe

Get alerted when CVE-2020-11610 or the next vulnerability affects your stack