PT-2019-19989 · Ethereum · Web3

Published 2019-05-30 · Updated 2019-05-30

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions web3 versions (affected versions not specified)

Description The issue concerns Insecure Credential Storage. The package stores encrypted wallets in local storage and requires a password to load the wallet. Once the wallet is loaded, the private key is accessible via LocalStorage. Exploiting this issue likely requires a Cross-Site Scripting vulnerability to access the private key.

Recommendations Consider using an alternative module until a fix is made available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

GHSA-27V7-QHFV-RQQ8

Affected Products

Web3

References · 5

• https://osv.dev/vulnerability/GHSA-27v7-qhfv-rqq8 · Vendor Advisory
• https://github.com/ethereum/web3.js · Note
• https://github.com/ethereum/web3.js/issues/2739 · Note
• https://snyk.io/vuln/SNYK-JS-WEB3-174533 · Note
• https://npmjs.com/advisories/877 · Note