Description
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
Remediation
References
https://github.com/socketio/socket.io/issues/3671
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1056358
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1056357
https://snyk.io/vuln/SNYK-JS-SOCKETIO-1024859
Related Vulnerabilities
CVE-2020-2229 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2018-3784 Vulnerability in npm package cryo
CVE-2021-39194 Vulnerability in maven package com.charleskorn.kaml:kaml
CVE-2020-28464 Vulnerability in npm package djv
CVE-2021-21391 Vulnerability in npm package @ckeditor/ckeditor5-paste-from-office