Every CVE Search/ Get API key

CVE-2020-28481

Insecure Defaults

5.3 MediumFix available

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.74%Down 0.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 5.3

Insecure Defaults

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.

Record
CVE-2020-28481
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
Updated
2026-11-02
EUVDEUVD-2021-0502 5.3

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.

Record
EUVD-2021-0502
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
Updated
2026-11-03
GitHub AdvisoriesGHSA-fxwf-4rqh-v8g3 4.3

CORS misconfiguration in socket.io

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.

Record
GHSA-fxwf-4rqh-v8g3
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-346, CWE-453
Updated
2026-11-02
NVD 5.3

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.

Record
CVE-2020-28481
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0
4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness
CWE-346
Updated
2026-11-02
OSVAZL-44430 4.3

CVE-2020-28481 affecting package js-jquery 3.5.0-4

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.

Record
AZL-44430
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSV 4.3

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.

Record
CVE-2020-28481
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
Show 5 moreShow less
OSVGHSA-fxwf-4rqh-v8g3 4.3

CORS misconfiguration in socket.io

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.

Record
GHSA-fxwf-4rqh-v8g3
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-346, CWE-453
Updated
2026-11-02
OSVCLSA-2026-1771978231 No score

TuxCare security update for socket.io (1 CVE)

TuxCare rebuilt socket.io to address 1 CVE. Fixed in 2.1.1-tuxcare.1.

Record
CLSA-2026-1771978231
Updated
2026-11-02
OSVCLSA-2026-1776818218 No score

TuxCare security update for socket.io (2 CVEs)

TuxCare rebuilt socket.io to address 2 CVEs. Fixed in 2.0.4-tuxcare.1.

Record
CLSA-2026-1776818218
Updated
2026-11-02
OSVCLSA-2026-1792604680 No score

TuxCare security update for socket.io (2 CVEs)

TuxCare rebuilt socket.io to address 2 CVEs. Fixed in 1.7.4-tuxcare.1.

Record
CLSA-2026-1792604680
Updated
2026-11-02
OSVCLSA-2026-1793304087 No score

TuxCare security update for socket.io (2 CVEs)

TuxCare rebuilt socket.io to address 2 CVEs. Fixed in 1.7.3-tuxcare.1.

Record
CLSA-2026-1793304087
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
socket.io
npm
 before 2.4.0
2.4.0
js-jquery
Azure Linux:3
 through 3.5.0-4 None known
socket.io
TuxCare:npm
 2.1.1-tuxcare.0 up to 2.1.1-tuxcare.1, plus listed versions
2.1.1
2.1.1-tuxcare.1
socket.io
TuxCare:npm
 2.0.4-tuxcare.0 up to 2.0.4-tuxcare.1, plus listed versions
2.0.4
2.0.4-tuxcare.1
socket.io
TuxCare:npm
 1.7.4-tuxcare.0 up to 1.7.4-tuxcare.1, plus listed versions
1.7.4
1.7.4-tuxcare.1
socket.io
TuxCare:npm
 1.7.3-tuxcare.0 up to 1.7.3-tuxcare.1, plus listed versions
1.7.3
1.7.3-tuxcare.1

History

History
RecordedChangedSources
aliases, products, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-28481 is a medium vulnerability (CVSS 5.3) in Socket Socket.io, published January 19, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 54th percentile. Fixed in socket.io 2.4.0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open