Fix CVE–2020–28481

[debricked]

CVE–2020–28481

Vulnerability details

Description

Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

GitHub

CORS misconfiguration in socket.io

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.

NVD

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.

GitLab Advisory Database (Open Source Edition)

Origin Validation Error

The package socket.io are vulnerable to Insecure Defaults due to CORS Misconfiguration.

CVSS details - 4.3

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	Low
User interaction	None
Scope	Unchanged
Confidentiality	Low
Integrity	None
Availability	None

References

    NVD - CVE-2020-28481
    CORS misconfiguration in socket.io · CVE-2020-28481 · GitHub Advisory Database · GitHub
    npm/socket.io/CVE-2020-28481.yml · main · GitLab.org / GitLab Advisory Database Open Source Edition · GitLab
    CORS Misconfiguration in socket.io · Issue #3671 · socketio/socket.io · GitHub
    GitHub - socketio/socket.io: Realtime application framework (Node.JS server)
    fix(security): do not allow all origins by default · socketio/socket.io@f78a575 · GitHub

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE