Vulnerability Details CVE-2020-24807
The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 70.0%
CVSS Severity
CVSS v3 Score 7.8
CVSS v2 Score 6.8
References
- https://github.com/advisories/GHSA-6495-8jvh-f28x
- https://github.com/rico345100/socket.io-file
- https://www.npmjs.com/advisories/1564
- https://www.npmjs.com/package/socket.io-file
- https://github.com/advisories/GHSA-6495-8jvh-f28x
- https://github.com/rico345100/socket.io-file
- https://www.npmjs.com/advisories/1564
- https://www.npmjs.com/package/socket.io-file
Products affected by CVE-2020-24807
-
cpe:2.3:a:socket.io-file_project:socket.io-file:1.0.0
-
cpe:2.3:a:socket.io-file_project:socket.io-file:1.0.1
-
cpe:2.3:a:socket.io-file_project:socket.io-file:1.0.11
-
cpe:2.3:a:socket.io-file_project:socket.io-file:1.0.12
-
cpe:2.3:a:socket.io-file_project:socket.io-file:1.0.13
-
cpe:2.3:a:socket.io-file_project:socket.io-file:1.0.2
-
cpe:2.3:a:socket.io-file_project:socket.io-file:1.0.21
-
cpe:2.3:a:socket.io-file_project:socket.io-file:1.0.3
-
cpe:2.3:a:socket.io-file_project:socket.io-file:1.0.31
-
cpe:2.3:a:socket.io-file_project:socket.io-file:1.0.32
-
cpe:2.3:a:socket.io-file_project:socket.io-file:1.0.4
-
cpe:2.3:a:socket.io-file_project:socket.io-file:1.0.41
-
cpe:2.3:a:socket.io-file_project:socket.io-file:1.0.5
-
cpe:2.3:a:socket.io-file_project:socket.io-file:1.0.51
-
cpe:2.3:a:socket.io-file_project:socket.io-file:1.0.52
-
cpe:2.3:a:socket.io-file_project:socket.io-file:1.0.53
-
cpe:2.3:a:socket.io-file_project:socket.io-file:1.0.54
-
cpe:2.3:a:socket.io-file_project:socket.io-file:1.0.55
-
cpe:2.3:a:socket.io-file_project:socket.io-file:1.0.56
-
cpe:2.3:a:socket.io-file_project:socket.io-file:1.0.57
-
cpe:2.3:a:socket.io-file_project:socket.io-file:1.0.58
-
cpe:2.3:a:socket.io-file_project:socket.io-file:1.0.59
-
cpe:2.3:a:socket.io-file_project:socket.io-file:2.0.0
-
cpe:2.3:a:socket.io-file_project:socket.io-file:2.0.1
-
cpe:2.3:a:socket.io-file_project:socket.io-file:2.0.12
-
cpe:2.3:a:socket.io-file_project:socket.io-file:2.0.13
-
cpe:2.3:a:socket.io-file_project:socket.io-file:2.0.14
-
cpe:2.3:a:socket.io-file_project:socket.io-file:2.0.15
-
cpe:2.3:a:socket.io-file_project:socket.io-file:2.0.2
-
cpe:2.3:a:socket.io-file_project:socket.io-file:2.0.3
-
cpe:2.3:a:socket.io-file_project:socket.io-file:2.0.31