CVE-2015-9545: Improper Input Validation
An issue was discovered in xdLocalStorage The receiveMessage() function in xdLocalStorage.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the confidentiality and integrity of data in the local storage of the vulnerable site via malicious web messages.
References
- github.com/advisories/GHSA-76qm-4f93-fg6f
- github.com/ofirdagan/cross-domain-local-storage
- github.com/ofirdagan/cross-domain-local-storage/issues/17
- github.com/ofirdagan/cross-domain-local-storage/pull/19
- grimhacker.com/exploiting-xdlocalstorage-localstorage-and-postmessage/
- nvd.nist.gov/vuln/detail/CVE-2015-9545
Code Behaviors & Features
Detect and mitigate CVE-2015-9545 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →