exploitDog

CVE-2020-28481

Опубликовано: 19 янв. 2021

Источник: nvd

CVSS3: 5.3

CVSS3: 4.3

CVSS2: 4

EPSS Низкий

Описание

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.

Ссылки

https://github.com/socketio/socket.io/issues/3671
Exploit
Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1056358
Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1056357
Third Party Advisory
https://snyk.io/vuln/SNYK-JS-SOCKETIO-1024859
Third Party Advisory
https://github.com/socketio/socket.io/issues/3671
Exploit
Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1056358
Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1056357
Third Party Advisory
https://snyk.io/vuln/SNYK-JS-SOCKETIO-1024859
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:socket:socket.io:*:*:*:*:*:node.js:*:*

Версия до 2.4.0 (исключая)

EPSS

Процентиль: 41%

0.00189

Низкий

5.3 Medium

CVSS3

4.3 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-346

Связанные уязвимости

GHSA-fxwf-4rqh-v8g3

CVSS3: 4.3

github

около 5 лет назад

CORS misconfiguration in socket.io

EPSS

Процентиль: 41%

0.00189

Низкий

5.3 Medium

CVSS3

4.3 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-346