Security readout for executives and security teams
Plain-English summary
PreMiD through 2.1.3 ran a local Socket.IO server on port 3020 that accepted requests from any web origin. A malicious webpage could potentially read sensitive Discord user information from a user running the vulnerable client. The issue is privacy-focused, not described as code execution.
Executive priority
Treat this as a targeted endpoint privacy risk. Prioritize organizations where PreMiD is allowed, Discord identity exposure is sensitive, or users routinely browse untrusted sites. The limited public evidence keeps urgency below critical.
Technical view
The CVE identifies managers/socketManager.ts in PreMiD through 2.1.3 as exposing a locally hosted Socket.IO web server with permissive origin handling. The reported impact is disclosure of sensitive Discord user information. The source bundle provides no CVSS score, CWE mapping, or detailed patch notes beyond the linked pull request.
Likely exposure
Exposure is most likely on endpoints where users installed PreMiD through version 2.1.3 and the local service is running. The bundle does not identify server-side products, cloud assets, or broader platform exposure.
Exploitation context
The sources do not report active exploitation, and the CVE is not listed as KEV in the supplied bundle. Practical abuse appears to require a victim endpoint running vulnerable PreMiD and interaction with attacker-controlled web content or another untrusted origin.
Researcher notes
Evidence is sparse: no CVSS, CWE, affected CPEs, exploit confirmation, or explicit fixed version is included in the bundle. Anchor analysis to PreMiD through 2.1.3, permissive local Socket.IO origin handling, and potential Discord user information disclosure.
Mitigation direction
- Identify endpoints running PreMiD through 2.1.3.
- Review vendor guidance and PR #501 for the intended fix.
- Upgrade or remove affected PreMiD installations where feasible.
- Restrict use of untrusted web content on affected endpoints until remediated.
- Monitor for unexpected local service exposure on port 3020.
Validation and detection
- Inventory installed PreMiD versions across managed endpoints.
- Confirm whether the local Socket.IO service is present on port 3020.
- Verify origin restrictions after applying vendor-provided updates.
- Review browser or endpoint telemetry for suspicious local service access.
- Document whether Discord user information is exposed in controlled testing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-24928 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/PreMiD/PreMiD/pull/501CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.