CVE-2015-9545
High
Description
An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStorage.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the confidentiality and integrity of data in the local storage of the vulnerable site via malicious web messages.
SeverityHigh
CVSS7.1
Exploit probability—
ProductXdlocalstorage
PublishedApr 7, 2020
First seenApr 7, 2020
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xdlocalstoragenpm | v ≤ 2.0.5 | — |
| cross_domain_local_storage_project cross_domain_local_storage | v ≤ 2.0.5 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.