Description (CNA)
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / socket.io | affected unspecified before 2.4.0 |
CWE
No CWE identifiers supplied.
References
- https://snyk.io/vuln/SNYK-JS-SOCKETIO-1024859
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1056357
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1056358
- https://github.com/socketio/socket.io/issues/3671
ADP enrichment
No English description supplied.