WS-2019-0075 (Medium) detected in web3-0.20.6.tgz

[mend-for-github-com]

WS-2019-0075 - Medium Severity Vulnerability

Vulnerable Library - web3-0.20.6.tgz

Ethereum JavaScript API, middleware to talk to a ethereum node over RPC

Library home page: https://registry.npmjs.org/web3/-/web3-0.20.6.tgz

Path to dependency file: cljsjs-packages/zeroxproject-connect/resources/package.json

Path to vulnerable library: cljsjs-packages/zeroxproject-connect/resources/node_modules/web3/package.json

Dependency Hierarchy:

• connect-0.6.17.tgz (Root Library)
  • utils-0.7.3.tgz
    • ❌ web3-0.20.6.tgz (Vulnerable Library)

Found in HEAD commit: 8a38269487e0a698bfe2cc3ea9bcb4dea2b06090

Found in base branch: master

Vulnerability Details

All versions of web3 are vulnerable to Insecure Credential Storage

Publish Date: 2019-05-15

URL: WS-2019-0075

CVSS 2 Score Details (5.5)

Base Score Metrics not available