CORS misconfiguration in socket.io · CVE-2020-28481 · GitHub Advisory Database · GitHub

CORS misconfiguration in socket.io

Moderate severity GitHub Reviewed Published Jan 20, 2021 to the GitHub Advisory Database • Updated Sep 11, 2023

Package

socket.io (npm)

Affected versions

< 2.4.0

Patched versions

2.4.0

Description

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.

References

Published by the National Vulnerability Database

Jan 19, 2021

Reviewed Jan 20, 2021

Published to the GitHub Advisory Database Jan 20, 2021

Last updated Sep 11, 2023

Severity

Moderate

4.3

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N