CVE-2020-11611

An issue was discovered in xdLocalStorage through 2.0.5. The buildMessage() function in xdLocalStorage.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the iframe object. Therefore any domain that is currently loaded within the iframe can receive the messages that the client sends.

• CWE-601

• https://github.com/ofirdagan/cross-domain-local-storageProduct, Third Party Advisory
• https://grimhacker.com/exploiting-xdlocalstorage-localstorage-and-postmessage/#Missing-TargetOrigin-ClientExploit, Third Party Advisory
• https://github.com/ofirdagan/cross-domain-local-storageProduct, Third Party Advisory
• https://grimhacker.com/exploiting-xdlocalstorage-localstorage-and-postmessage/#Missing-TargetOrigin-ClientExploit, Third Party Advisory

Published

Apr 7, 2020

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11606An issue was discovered on Samsung mobile devices with Q(10.…2.4
• CVE-2020-11607An issue was discovered on Samsung mobile devices with P(9.0…5.3
• CVE-2020-11608An issue was discovered in the Linux kernel before 5.6.1. dr…4.3
• CVE-2020-11609An issue was discovered in the stv06xx subsystem in the Linu…4.3
• CVE-2020-1161A denial of service vulnerability exists when ASP.NET Core i…7.5
• CVE-2020-11610An issue was discovered in xdLocalStorage through 2.0.5. The…8.8
• CVE-2020-11612The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbo…7.5
• CVE-2020-11613Mids' Reborn Hero Designer 2.6.0.7 has an elevation of privi…7.8
• CVE-2020-11614Mids' Reborn Hero Designer 2.6.0.7 downloads the update mani…8.1
• CVE-2020-11615NVIDIA DGX servers, all BMC firmware versions prior to 3.38.…7.5
• CVE-2020-11616NVIDIA DGX servers, all BMC firmware versions prior to 3.38.…7.5
• CVE-2020-11617The RSS application on THOMSON THT741FTA 2.2.1 and Philips D…5.9