~ / search / GHSA-fxwf-4rqh-v8g3

GHSA-fxwf-4rqh-v8g3

CORS misconfiguration in socket.io

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-28481

Packages

EcosystemPackageAffectedFixed in
npm socket.io < 2.4.0 2.4.0

Details

As written in the advisory (Markdown source, shown as plain text).

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.

References

External links from the advisory. They lead to third-party sites.