What is GHSA-fxwf-4rqh-v8g3?

GHSA-fxwf-4rqh-v8g3 is a security advisory published by GitHub Security Advisories with Medium severity. CORS misconfiguration in socket.io

Which CVE IDs does GHSA-fxwf-4rqh-v8g3 cover?

GHSA-fxwf-4rqh-v8g3 covers the following CVE IDs: CVE-2020-28481. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fxwf-4rqh-v8g3?

GHSA-fxwf-4rqh-v8g3 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-fxwf-4rqh-v8g3?

GHSA-fxwf-4rqh-v8g3 affects 1 product, including: npm/socket.io:\u003c 2.4.0.

GHSA-fxwf-4rqh-v8g3MediumCVSS 4.3

CORS misconfiguration in socket.io

Vendor

GitHub Security Advisories

Published

January 20, 2021

Last Modified

September 11, 2023

🔗 CVE IDs covered (1)

CVE-2020-28481 →

📋 Description

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.

🎯 Affected products1

npm/socket.io:< 2.4.0

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2020-28481
https://github.com/socketio/socket.io/issues/3671
https://github.com/socketio/socket.io/commit/f78a575f66ab693c3ea96ea88429ddb1a44c86c7
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1056358
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1056357
https://snyk.io/vuln/SNYK-JS-SOCKETIO-1024859
https://github.com/advisories/GHSA-fxwf-4rqh-v8g3