Lookup for vulnerable packages by Package URL.
| Purl | pkg:npm/web3@0.20.7 |
|---|
| Type | npm |
|---|
| Namespace | |
|---|
| Name | web3 |
|---|
| Version | 0.20.7 |
|---|
| Qualifiers |
|
|---|
| Subpath | |
|---|
| Is_vulnerable | true |
|---|
| Next_non_vulnerable_version | null |
|---|
| Latest_non_vulnerable_version | null |
|---|
| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-9hm9-fg45-27gq |
| vulnerability_id |
VCID-9hm9-fg45-27gq |
| summary |
Insecure Credential Storage in web3
All versions of `web3` are vulnerable to Insecure Credential Storage. The package stores encrypted wallets in local storage and requires a password to load the wallet. Once the wallet is loaded, the private key is accessible via LocalStorage. Exploiting this vulnerability likely requires a Cross-Site Scripting vulnerability to access the private key. No fix is currently available. Consider using an alternative module until a fix is made available. |
| references |
|
| fixed_packages |
|
| aliases |
GHSA-27v7-qhfv-rqq8, GMS-2019-66
|
| risk_score |
1.4 |
| exploitability |
0.5 |
| weighted_severity |
2.7 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-9hm9-fg45-27gq |
|
|
|---|
| Fixing_vulnerabilities |
|
|---|
| Risk_score | 1.4 |
|---|
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:npm/web3@0.20.7 |
|---|