DerScanner
Home / Vulnerability Database / JavaScript : Overly permissive message posting policy
JavaScript

JavaScript : Overly permissive message posting policy

Classification

OWASP Top 10 2013
A5-Security Misconfiguration
OWASP Top 10 2017
A5-Broken Access Control
OWASP Top 10 2021
A1-Broken Access Control
HIPAA
§164.312 (a)(1)
CWE
CWE-1031

Overview

The application sends a cross-document message with an overly permissive target origin.

HTML5 allows to send messages to other windows via cross-document messaging. The target window must be specified. Overly permissive target origin may allow a malicious script to violate data confidentiality.

References

  1. HTML5 Security in a Nutshell
  2. OWASP Top 10 2017-A5-Broken Access Control
  3. CWE CATEGORY: OWASP Top Ten 2017 Category A5 - Broken Access Control
MEDIUM

DerScanner Severity Score

Do you want to fix JavaScript : Overly permissive message posting policy in your application?

See also

JavaScript

JavaScript : Null salt

JavaScript

JavaScript : Empty encryption key

JavaScript

JavaScript : Unsafe Azure access control