DerScanner
Home / Vulnerability Database / TypeScript : Overly permissive message posting policy
TypeScript

TypeScript : Overly permissive message posting policy

Classification

OWASP Top 10 2013
A5-Security Misconfiguration
OWASP Top 10 2017
A5-Broken Access Control
OWASP Top 10 2021
A1-Broken Access Control
HIPAA
§164.312 (a)(1)
CWE
CWE-1031

Overview

The application sends a cross-document message with an overly permissive target origin.

HTML5 allows to send messages to other windows via cross-document messaging. The target window must be specified. Overly permissive target origin may allow a malicious script to violate data confidentiality.

References

  1. HTML5 Security in a Nutshell
  2. OWASP Top 10 2017-A5-Broken Access Control
  3. CWE CATEGORY: OWASP Top Ten 2017 Category A5 - Broken Access Control
MEDIUM

DerScanner Severity Score

Do you want to fix TypeScript : Overly permissive message posting policy in your application?

See also

TypeScript

TypeScript : Unsafe Azure access control

TypeScript

TypeScript : Debug code

TypeScript

TypeScript : XSS protection is disabled