CVE-2020-28481

2021-01-1915:15:12

Google

osv.dev

6.7 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.0%

JSON

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.

CPENameOperatorVersion
socket.ioeq0.9.5
socket.ioeq1.4.3
socket.ioeq0.9.7
socket.ioeq0.9.10
socket.ioeq1.0.3
socket.ioeq2.1.0
socket.ioeq1.0.0
socket.ioeq0.7.11
socket.ioeq1.4.7
socket.ioeq2.0.2

Name	Operator	Version
socket.io	eq	0.9.5
socket.io	eq	1.4.3
socket.io	eq	0.9.7
socket.io	eq	0.9.10
socket.io	eq	1.0.3
socket.io	eq	2.1.0
socket.io	eq	1.0.0
socket.io	eq	0.7.11
socket.io	eq	1.4.7
socket.io	eq	2.0.2