medium5.3
CVE-2020-28481
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration.
Impact
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Socket | Socket.Io | before 2.4.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/socketio/socket.io/issues/3671
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1056358
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1056357
- https://snyk.io/vuln/SNYK-JS-SOCKETIO-1024859
- https://github.com/socketio/socket.io/issues/3671
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1056358
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1056357
- https://snyk.io/vuln/SNYK-JS-SOCKETIO-1024859