5.3
Medium
CVE-2020-28481 The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration
Description
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| socket.io 2.4 | earliest → < 2.4.0 | 2.4.0 |