{"action":"Upgrade socket.io to 2.4.0 or later.","affected":[{"fixed":"2.4.0","introduced":"0"}],"component":"socket.io","cve_ids":["CVE-2020-28481"],"ecosystem":"npm","epss":0.00745,"exploited":false,"fixed_versions":["2.4.0"],"ghsa_id":"GHSA-fxwf-4rqh-v8g3","id":"tcs_01M5KFPMV1E9Q61ADCHQANGYQZ","modified_at":"2025-01-14T08:56:59.028253Z","published_at":"2021-01-20T21:22:37Z","references":["https://osv.dev/vulnerability/GHSA-fxwf-4rqh-v8g3","https://nvd.nist.gov/vuln/detail/CVE-2020-28481","https://github.com/socketio/socket.io/issues/3671","https://github.com/socketio/socket.io/commit/f78a575f66ab693c3ea96ea88429ddb1a44c86c7","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1056358","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1056357","https://snyk.io/vuln/SNYK-JS-SOCKETIO-1024859"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-fxwf-4rqh-v8g3","url":"https://osv.dev/vulnerability/GHSA-fxwf-4rqh-v8g3"}],"summary":"CORS misconfiguration in socket.io"}