NodeJS/web3/1.3.4


Ethereum JavaScript API

https://www.npmjs.com/package/web3
LGPL-3.0-only

1 Security Vulnerabilities

Insecure Credential Storage in web3

Published date: 2019-05-30T17:26:30Z
Links:

All versions of web3 are vulnerable to Insecure Credential Storage. The package stores encrypted wallets in local storage and requires a password to load the wallet. Once the wallet is loaded, the private key is accessible via LocalStorage. Exploiting this vulnerability likely requires a Cross-Site Scripting vulnerability to access the private key.

Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Affected versions: ["0.2.5", "0.2.6", "0.2.7", "0.2.8", "0.3.0", "0.3.1", "0.3.2", "0.3.3", "0.3.4", "0.3.6", "0.4.0", "0.4.1", "0.4.2", "0.4.3", "0.5.0", "0.6.0", "0.7.0", "0.7.1", "0.8.0", "0.8.1", "0.9.0", "0.9.1", "0.9.2", "0.10.0", "0.11.0", "0.12.0", "0.12.1", "0.12.2", "0.13.0", "0.14.0", "0.14.1", "0.15.0", "0.15.1", "0.15.2", "0.15.3", "0.16.0", "0.17.0-alpha", "0.17.0-beta", "0.18.0", "0.18.1", "0.18.2", "0.18.4", "0.19.0", "0.19.1", "0.20.0", "0.20.1", "1.0.0-beta1", "1.0.0-beta2", "1.0.0-beta.1", "1.0.0-beta.2", "1.0.0-beta.3", "1.0.0-beta.4", "1.0.0-beta.5", "1.0.0-beta.6", "1.0.0-beta.7", "1.0.0-beta.9", "1.0.0-beta.10", "1.0.0-beta.11", "1.0.0-beta.12", "1.0.0-beta.13", "1.0.0-beta.14", "1.0.0-beta.15", "1.0.0-beta.16", "1.0.0-beta.17", "1.0.0-beta.18", "0.20.2", "1.0.0-beta.19", "1.0.0-beta.20", "1.0.0-beta.21", "1.0.0-beta.22", "1.0.0-beta.23", "1.0.0-beta.24", "1.0.0-beta.25", "1.0.0-beta.26", "0.20.3", "1.0.0-beta.27", "1.0.0-beta.28", "0.20.4", "1.0.0-beta.29", "0.20.5", "1.0.0-beta.30", "1.0.0-beta.31", "0.20.6", "1.0.0-beta.32", "1.0.0-beta.33", "1.0.0-beta.34", "0.20.7", "1.0.0-beta.35", "1.0.0-beta.36", "1.0.0-beta.37", "1.0.0-beta.38", "1.0.0-beta.39", "1.0.0-beta.40", "1.0.0-beta.41", "1.0.0-beta.42", "1.0.0-beta.43", "1.0.0-beta.44", "1.0.0-beta.46", "1.0.0-beta.47", "1.0.0-beta.48", "1.0.0-beta.49", "1.0.0-beta.50", "1.0.0-beta.51", "1.0.0-beta.52", "1.0.0-beta.53", "1.0.0-beta.54", "1.0.0-beta.55", "1.2.0", "1.2.1", "1.2.2", "1.2.3", "1.2.4", "1.2.5-rc.0", "1.2.5", "1.2.6", "1.2.7-rc.0", "1.2.7", "1.2.8-rc.0", "1.2.8-rc.1", "1.2.8", "1.2.9-rc.0", "1.2.9", "1.2.10-rc.0", "1.2.10", "1.2.11", "1.3.0-rc.0", "1.3.0", "1.3.1", "1.3.2-rc.2", "1.3.2", "1.3.3", "1.3.4-rc.1", "1.3.4-rc.2", "1.3.4", "1.3.5-rc.0", "1.3.5", "1.3.6-rc.1", "1.3.6-rc.2", "1.3.6", "1.4.0-rc.0", "1.4.0", "1.5.0-rc.0", "1.5.0-rc.1", "1.5.0", "1.5.1-rc.0", "1.5.1-rc.1", "1.5.1", "1.5.2-rc.0", "1.5.2"]
Secure versions: [2.0.0-alpha, 2.0.0-alpha.1, 3.0.0-rc.0, 3.0.0-rc.1, 3.0.0-rc.4, 3.0.0-rc.5, 1.5.3-rc.0, 1.5.3, 1.6.0-rc.0, 1.6.0, 1.6.1-rc.0, 1.6.1-rc.2, 1.6.1-rc.3, 1.6.1, 1.7.0-rc.0, 1.7.0, 1.7.1-rc.0, 1.7.1, 1.7.2-rc.0, 1.7.2, 1.7.3-rc.0, 1.7.3, 1.7.4-rc.0, 1.7.4-rc.1, 1.7.4-rc.2, 1.7.4, 1.7.5-rc.0, 1.7.5-rc.1, 1.7.5, 4.0.0-alpha.0, 4.0.1-alpha.0, 1.8.0-rc.0, 1.8.0, 1.8.1-rc.0, 4.0.1-alpha.1, 1.8.1, 4.0.1-alpha.2, 4.0.1-alpha.3, 1.8.2-rc.0, 4.0.1-alpha.4, 4.0.1-alpha.5, 1.8.2, 1.9.0-rc.0, 4.0.1-rc.0, 1.9.0, 4.0.1-rc.1, 1.10.0-rc.0, 1.10.0, 4.0.1-rc.2, 4.0.1, 4.0.2-dev.af57eae.0, 4.0.2-dev.f8a2533.0, 4.0.2-dev.ab0f4cb.0, 4.0.2-dev.a2a232f.0, 4.0.2-dev.e8d579c.0, 4.0.2, 4.0.3-dev.a26a888.0, 4.0.3-dev.d12dc7e.0, 4.0.3, 4.0.4-dev.ebd0c57.0, 4.0.4-dev.e143157.0, 4.0.4-dev.ad377d1.0, 4.0.4-dev.b93934a.0, 4.0.4-dev.f5b4d7d.0, 4.0.4-dev.ed2770c.0, 4.0.4-dev.b771112.0, 1.10.1-rc.0, 4.1.0-rc.0, 1.10.1, 4.1.0, 4.1.1-dev.c41d356.0, 4.1.1-dev.f4fd498.0, 4.1.1-dev.a4cae6f.0, 4.1.1-dev.d41a49e.0, 4.1.1-dev.ec6e117.0, 4.1.1, 4.1.2-dev.a325689.0, 1.10.2, 4.1.2-dev.da3e2f5.0, 4.1.2-dev.e4ba45c.0, 4.1.2, 4.1.3-dev.d036166.0, 4.1.3-dev.b8fa712.0, 4.1.3-dev.c490c18.0, 4.1.3-dev.bfcbea8.0, 4.1.3-dev.ae98628.0, 4.1.3-dev.b38f00d.0, 4.1.3-dev.e760667.0, 1.10.3, 4.2.0, 4.2.1-dev.bd3b9a0.0, 4.2.1-dev.a0d6730.0, 4.2.1-dev.f860b04.0, 4.2.1, 4.2.2-dev.f6c7fca.0, 4.2.2-dev.b05345b.0, 4.2.2-dev.f9bcac9.0, 4.2.2, 4.2.3-dev.bcd0706.0, 4.2.3-dev.b9da5a5.0, 4.2.3-dev.ef6f04e.0, 4.2.3-dev.be86e25.0, 4.2.3-dev.d8b8e18.0, 4.2.3-dev.af91519.0, 4.2.3-dev.f8d8774.0, 4.2.3-dev.e6d8c14.0, 4.2.3-dev.b3ccd5c.0, 4.3.0, 4.3.1-dev.cdd99e7.0, 4.3.1-dev.b819ee4.0, 4.3.1-dev.f1c6916.0, 4.3.1-dev.b35eca1.0, 4.3.1-dev.c858390.0, 4.3.1-dev.a4f2f8c.0, 4.3.1-dev.e1080d9.0, 4.3.1-dev.e442fd2.0, 4.3.1-dev.f7d9349.0, 4.3.1-dev.fa4c72b.0, 4.3.1-dev.c097b9a.0, 4.3.1-dev.f9468a8.0, 4.3.1-dev.df594c9.0, 4.3.1-dev.b188714.0, 4.3.1-dev.cc7ff1f.0, 4.3.1-dev.a3fe342.0, 4.4.0, 4.4.1-dev.b49094b.0, 4.4.1-dev.aac2420.0, 4.4.1-dev.a72e99a.0, 1.10.4, 4.4.1-dev.e5673ca.0, 4.4.1-dev.a6b685e.0, 4.4.1-dev.ed1460c.0, 4.4.1-dev.d8b64a8.0, 4.5.0, 4.5.1-dev.a0d4d2e.0, 4.5.1-dev.e774646.0, 4.5.1-dev.f696e47.0, 4.5.1-dev.ec65468.0, 4.5.1-dev.c5cecaf.0, 4.5.1-dev.a2d9cb4.0, 4.5.1-dev.afece40.0, 4.5.1-dev.cf4b93f.0, 4.5.1-dev.b4c92e1.0, 4.5.1-dev.b25b883.0, 4.5.1-dev.ab1b250.0, 4.5.1-dev.bd6cc71.0, 4.5.1-dev.ca31f6a.0, 4.5.1-dev.edf3164.0, 4.5.1-dev.cf60f71.0, 4.6.0, 4.6.1-dev.e383ae3.0, 4.6.1-dev.d254316.0, 4.6.1-dev.a1f9dc4.0, 4.6.1-dev.f943944.0, 4.6.1-dev.a83e9d5.0, 4.6.1-dev.c4e039a.0, 4.7.0, 4.7.1-dev.a173a8f.0]
Recommendation: Update to version 4.7.0.

307 Other Versions

Version License Security Released
4.7.1-dev.a173a8f.0 LGPL-3.0-only 2024-03-26 - 18:01 1 day
4.7.0 LGPL-3.0-only 2024-03-26 - 17:55 1 day
4.6.1-dev.d254316.0 LGPL-3.0-only 2024-03-11 - 19:14 17 days
4.6.1-dev.a1f9dc4.0 LGPL-3.0-only 2024-03-12 - 10:17 16 days
4.6.1-dev.e383ae3.0 LGPL-3.0-only 2024-03-08 - 15:41 20 days
4.6.1-dev.a83e9d5.0 LGPL-3.0-only 2024-03-25 - 14:11 3 days
4.6.1-dev.f943944.0 LGPL-3.0-only 2024-03-20 - 14:16 8 days
4.6.1-dev.c4e039a.0 LGPL-3.0-only 2024-03-25 - 19:00 3 days
4.6.0 LGPL-3.0-only 2024-03-08 - 15:33 20 days
4.5.1-dev.ec65468.0 LGPL-3.0-only 2024-02-16 - 17:19 about 1 month
4.5.1-dev.a2d9cb4.0 LGPL-3.0-only 2024-02-19 - 12:44 about 1 month
4.5.1-dev.e774646.0 LGPL-3.0-only 2024-02-14 - 09:46 about 1 month
4.5.1-dev.edf3164.0 LGPL-3.0-only 2024-03-07 - 08:54 21 days
4.5.1-dev.ca31f6a.0 LGPL-3.0-only 2024-03-05 - 17:05 23 days
4.5.1-dev.cf60f71.0 LGPL-3.0-only 2024-03-07 - 12:07 21 days
4.5.1-dev.c5cecaf.0 LGPL-3.0-only 2024-02-19 - 12:44 about 1 month
4.5.1-dev.a0d4d2e.0 LGPL-3.0-only 2024-02-12 - 14:26 about 1 month
4.5.1-dev.f696e47.0 LGPL-3.0-only 2024-02-15 - 15:55 about 1 month
4.5.1-dev.b4c92e1.0 LGPL-3.0-only 2024-02-27 - 14:58 30 days
4.5.1-dev.afece40.0 LGPL-3.0-only 2024-02-27 - 14:28 30 days
4.5.1-dev.b25b883.0 LGPL-3.0-only 2024-02-28 - 16:27 29 days
4.5.1-dev.bd6cc71.0 LGPL-3.0-only 2024-03-01 - 21:14 27 days
4.5.1-dev.ab1b250.0 LGPL-3.0-only 2024-02-28 - 16:44 29 days
4.5.1-dev.cf4b93f.0 LGPL-3.0-only 2024-02-27 - 14:46 30 days
4.5.0 LGPL-3.0-only 2024-02-12 - 13:50 about 1 month
4.4.1-dev.aac2420.0 LGPL-3.0-only 2024-01-24 - 18:32 2 months
4.4.1-dev.b49094b.0 LGPL-3.0-only 2024-01-23 - 07:47 2 months
4.4.1-dev.ed1460c.0 LGPL-3.0-only 2024-02-06 - 20:46 about 2 months
4.4.1-dev.e5673ca.0 LGPL-3.0-only 2024-02-05 - 15:30 about 2 months
4.4.1-dev.d8b64a8.0 LGPL-3.0-only 2024-02-09 - 16:14 about 2 months
4.4.1-dev.a72e99a.0 LGPL-3.0-only 2024-01-29 - 21:20 about 2 months
4.4.1-dev.a6b685e.0 LGPL-3.0-only 2024-02-05 - 15:37 about 2 months
4.4.0 LGPL-3.0-only 2024-01-17 - 17:31 2 months
4.3.1-dev.a3fe342.0 LGPL-3.0-only 2024-01-15 - 14:01 2 months
4.3.1-dev.df594c9.0 LGPL-3.0-only 2024-01-05 - 09:58 3 months
4.3.1-dev.cc7ff1f.0 LGPL-3.0-only 2024-01-08 - 19:50 3 months
4.3.1-dev.c858390.0 LGPL-3.0-only 2023-12-12 - 13:34 4 months
4.3.1-dev.a4f2f8c.0 LGPL-3.0-only 2023-12-12 - 14:13 4 months
4.3.1-dev.b188714.0 LGPL-3.0-only 2024-01-08 - 11:05 3 months
4.3.1-dev.f9468a8.0 LGPL-3.0-only 2024-01-04 - 11:10 3 months
4.3.1-dev.b35eca1.0 LGPL-3.0-only 2023-12-12 - 13:31 4 months
4.3.1-dev.f7d9349.0 LGPL-3.0-only 2023-12-14 - 16:09 3 months
4.3.1-dev.cdd99e7.0 LGPL-3.0-only 2023-12-05 - 03:54 4 months
4.3.1-dev.fa4c72b.0 LGPL-3.0-only 2023-12-15 - 16:26 3 months
4.3.1-dev.b819ee4.0 LGPL-3.0-only 2023-12-05 - 10:43 4 months
4.3.1-dev.f1c6916.0 LGPL-3.0-only 2023-12-05 - 15:27 4 months
4.3.1-dev.c097b9a.0 LGPL-3.0-only 2023-12-15 - 16:41 3 months
4.3.1-dev.e1080d9.0 LGPL-3.0-only 2023-12-13 - 17:26 4 months
4.3.1-dev.e442fd2.0 LGPL-3.0-only 2023-12-14 - 05:41 4 months
4.3.0 LGPL-3.0-only 2023-12-04 - 22:17 4 months
4.2.3-dev.bcd0706.0 LGPL-3.0-only 2023-11-20 - 13:29 4 months
4.2.3-dev.af91519.0 LGPL-3.0-only 2023-11-20 - 20:04 4 months
4.2.3-dev.f8d8774.0 LGPL-3.0-only 2023-11-23 - 12:58 4 months
4.2.3-dev.b3ccd5c.0 LGPL-3.0-only 2023-11-28 - 20:20 4 months
4.2.3-dev.e6d8c14.0 LGPL-3.0-only 2023-11-28 - 15:05 4 months
4.2.3-dev.d8b8e18.0 LGPL-3.0-only 2023-11-20 - 18:12 4 months
4.2.3-dev.b9da5a5.0 LGPL-3.0-only 2023-11-20 - 13:40 4 months
4.2.3-dev.ef6f04e.0 LGPL-3.0-only 2023-11-20 - 17:12 4 months
4.2.3-dev.be86e25.0 LGPL-3.0-only 2023-11-20 - 17:23 4 months
4.2.2 LGPL-3.0-only 2023-11-03 - 12:31 5 months
4.2.2-dev.b05345b.0 LGPL-3.0-only 2023-11-01 - 15:30 5 months
4.2.2-dev.f9bcac9.0 LGPL-3.0-only 2023-11-02 - 10:03 5 months
4.2.2-dev.f6c7fca.0 LGPL-3.0-only 2023-10-31 - 13:36 5 months
4.2.1 LGPL-3.0-only 2023-10-25 - 16:26 5 months
4.2.1-dev.f860b04.0 LGPL-3.0-only 2023-10-23 - 15:15 5 months
4.2.1-dev.a0d6730.0 LGPL-3.0-only 2023-10-23 - 14:46 5 months
4.2.1-dev.bd3b9a0.0 LGPL-3.0-only 2023-10-18 - 14:03 5 months
4.2.0 LGPL-3.0-only 2023-10-18 - 13:44 5 months
4.1.3-dev.c490c18.0 LGPL-3.0-only 2023-09-28 - 11:32 6 months
4.1.3-dev.b8fa712.0 LGPL-3.0-only 2023-09-27 - 07:53 6 months
4.1.3-dev.b38f00d.0 LGPL-3.0-only 2023-10-12 - 15:05 6 months
4.1.3-dev.ae98628.0 LGPL-3.0-only 2023-10-09 - 16:53 6 months
4.1.3-dev.d036166.0 LGPL-3.0-only 2023-09-22 - 01:42 6 months
4.1.3-dev.bfcbea8.0 LGPL-3.0-only 2023-10-02 - 14:46 6 months
4.1.3-dev.e760667.0 LGPL-3.0-only 2023-10-13 - 02:01 6 months
4.1.2 LGPL-3.0-only 2023-09-19 - 14:00 6 months
4.1.2-dev.a325689.0 LGPL-3.0-only 2023-08-21 - 17:08 7 months
4.1.2-dev.e4ba45c.0 LGPL-3.0-only 2023-09-15 - 15:01 6 months
4.1.2-dev.da3e2f5.0 LGPL-3.0-only 2023-09-12 - 12:22 7 months
4.1.1 LGPL-3.0-only 2023-08-21 - 16:27 7 months
4.1.1-dev.c41d356.0 LGPL-3.0-only 2023-08-15 - 08:32 8 months
4.1.1-dev.a4cae6f.0 LGPL-3.0-only 2023-08-15 - 08:36 8 months
4.1.1-dev.ec6e117.0 LGPL-3.0-only 2023-08-17 - 20:09 7 months
4.1.1-dev.f4fd498.0 LGPL-3.0-only 2023-08-15 - 08:33 8 months
4.1.1-dev.d41a49e.0 LGPL-3.0-only 2023-08-17 - 20:06 7 months
4.1.0 LGPL-3.0-only 2023-08-15 - 08:12 8 months
4.1.0-rc.0 LGPL-3.0-only 2023-08-09 - 15:14 8 months
4.0.4-dev.f5b4d7d.0 LGPL-3.0-only 2023-07-20 - 14:45 8 months
4.0.4-dev.e143157.0 LGPL-3.0-only 2023-07-14 - 15:09 9 months
4.0.4-dev.ebd0c57.0 LGPL-3.0-only 2023-07-11 - 15:00 9 months
4.0.4-dev.ad377d1.0 LGPL-3.0-only 2023-07-14 - 16:02 9 months
4.0.4-dev.ed2770c.0 LGPL-3.0-only 2023-07-24 - 17:24 8 months
4.0.4-dev.b93934a.0 LGPL-3.0-only 2023-07-17 - 22:35 8 months
4.0.4-dev.b771112.0 LGPL-3.0-only 2023-08-01 - 10:06 8 months
4.0.3 LGPL-3.0-only 2023-07-11 - 14:46 9 months
4.0.3-dev.d12dc7e.0 LGPL-3.0-only 2023-06-27 - 19:17 9 months
4.0.3-dev.a26a888.0 LGPL-3.0-only 2023-06-27 - 12:17 9 months
4.0.2 LGPL-3.0-only 2023-06-27 - 12:02 9 months
4.0.2-dev.ab0f4cb.0 LGPL-3.0-only 2023-06-20 - 09:08 9 months
4.0.2-dev.af57eae.0 LGPL-3.0-only 2023-06-09 - 08:46 10 months