GitHub Advisoryadvisory · npm
GHSA-fxwf-4rqh-v8g3 CORS misconfiguration in socket.io
MEDIUM
Official page ↗
- Aliases
- CVE-2020-28481
- Ecosystem
- npm
- Packages
- socket.io
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-346, CWE-453
- Reviewed
- 2021-01-20
Affected packages
• npm socket.io: < 2.4.0 → fixed in 2.4.0
Description
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
Related
Alias · CVE (1)
- CVE-2020-28481 The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-28481 advisory
- https://github.com/socketio/socket.io/issues/3671 web
- https://github.com/socketio/socket.io/commit/f78a575f66ab693c3ea96ea88429ddb1a44c86c7 web
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1056358 web
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1056357 web
- https://snyk.io/vuln/SNYK-JS-SOCKETIO-1024859 web