GSD-2023-30543
Vulnerability from gsd - Updated: 2023-12-13 01:20Details
@web3-react is a framework for building Ethereum Apps . In affected versions the `chainId` may be outdated if the user changes chains as part of the connection flow. This means that the value of `chainId` returned by `useWeb3React()` may be incorrect. In an application, this means that any data derived from `chainId` could be incorrect. For example, if a swapping application derives a wrapped token contract address from the `chainId` *and* a user has changed chains as part of their connection flow the application could cause the user to send funds to the incorrect address when wrapping. This issue has been addressed in PR #749 and is available in updated npm artifacts. There are no known workarounds for this issue. Users are advised to upgrade.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2023-30543",
"id": "GSD-2023-30543"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2023-30543"
],
"details": "@web3-react is a framework for building Ethereum Apps . In affected versions the `chainId` may be outdated if the user changes chains as part of the connection flow. This means that the value of `chainId` returned by `useWeb3React()` may be incorrect. In an application, this means that any data derived from `chainId` could be incorrect. For example, if a swapping application derives a wrapped token contract address from the `chainId` *and* a user has changed chains as part of their connection flow the application could cause the user to send funds to the incorrect address when wrapping. This issue has been addressed in PR #749 and is available in updated npm artifacts. There are no known workarounds for this issue. Users are advised to upgrade.\n\n\n",
"id": "GSD-2023-30543",
"modified": "2023-12-13T01:20:51.900803Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2023-30543",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "web3-react",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "@web3-react/coinbase-wallet: \u003e= 6, \u003c 8.0.35-beta.0"
},
{
"version_affected": "=",
"version_value": "@web3-react/eip1193: \u003e= 6, \u003c 8.0.27-beta.0"
},
{
"version_affected": "=",
"version_value": "@web3-react/metamask: \u003e= 6, \u003c 8.0.30-beta.0"
},
{
"version_affected": "=",
"version_value": "@web3-react/walletconnect: \u003e= 6, \u003c 8.0.37-beta.0"
}
]
}
}
]
},
"vendor_name": "Uniswap"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "@web3-react is a framework for building Ethereum Apps . In affected versions the `chainId` may be outdated if the user changes chains as part of the connection flow. This means that the value of `chainId` returned by `useWeb3React()` may be incorrect. In an application, this means that any data derived from `chainId` could be incorrect. For example, if a swapping application derives a wrapped token contract address from the `chainId` *and* a user has changed chains as part of their connection flow the application could cause the user to send funds to the incorrect address when wrapping. This issue has been addressed in PR #749 and is available in updated npm artifacts. There are no known workarounds for this issue. Users are advised to upgrade.\n\n\n"
}
]
},
"impact": {
"cvss": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L",
"version": "3.1"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"cweId": "CWE-362",
"lang": "eng",
"value": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/Uniswap/web3-react/security/advisories/GHSA-8pf3-6fgr-3g3g",
"refsource": "MISC",
"url": "https://github.com/Uniswap/web3-react/security/advisories/GHSA-8pf3-6fgr-3g3g"
},
{
"name": "https://github.com/Uniswap/web3-react/pull/749",
"refsource": "MISC",
"url": "https://github.com/Uniswap/web3-react/pull/749"
}
]
},
"source": {
"advisory": "GHSA-8pf3-6fgr-3g3g",
"discovery": "UNKNOWN"
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003e=6.0.0 \u003c=6.2.14||\u003e=7.0.0 \u003c=7.0.2||\u003e=8.0.22 \u003c=8.0.34",
"affected_versions": "All versions starting from 6.0.0 up to 6.2.14, all versions starting from 7.0.0 up to 7.0.2, all versions starting from 8.0.22 up to 8.0.34",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-362",
"CWE-937"
],
"date": "2023-05-01",
"description": "@web3-react is a framework for building Ethereum Apps . In affected versions the `chainId` may be outdated if the user changes chains as part of the connection flow. This means that the value of `chainId` returned by `useWeb3React()` may be incorrect. In an application, this means that any data derived from `chainId` could be incorrect. For example, if a swapping application derives a wrapped token contract address from the `chainId` *and* a user has changed chains as part of their connection flow the application could cause the user to send funds to the incorrect address when wrapping. This issue has been addressed in PR #749 and is available in updated npm artifacts. There are no known workarounds for this issue. Users are advised to upgrade.\n\n\n",
"fixed_versions": [
"8.2.0"
],
"identifier": "CVE-2023-30543",
"identifiers": [
"CVE-2023-30543",
"GHSA-8pf3-6fgr-3g3g"
],
"not_impacted": "All versions before 6.0.0, all versions after 6.2.14 before 7.0.0, all versions after 7.0.2 before 8.0.22, all versions after 8.0.34",
"package_slug": "npm/@web3-react/coinbase-wallet",
"pubdate": "2023-04-17",
"solution": "Upgrade to version 8.2.0 or above.",
"title": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"urls": [
"https://github.com/Uniswap/web3-react/security/advisories/GHSA-8pf3-6fgr-3g3g",
"https://nvd.nist.gov/vuln/detail/CVE-2023-30543",
"https://github.com/Uniswap/web3-react/pull/749",
"https://github.com/advisories/GHSA-8pf3-6fgr-3g3g"
],
"uuid": "93ee1811-b45c-4b33-b7b9-f21684f4a7bb"
},
{
"affected_range": "\u003e=6.0.0 \u003c8.0.27-beta.0",
"affected_versions": "All versions starting from 6.0.0 before 8.0.27-beta.0",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-362",
"CWE-937"
],
"date": "2023-05-01",
"description": "@web3-react is a framework for building Ethereum Apps . In affected versions the `chainId` may be outdated if the user changes chains as part of the connection flow. This means that the value of `chainId` returned by `useWeb3React()` may be incorrect. In an application, this means that any data derived from `chainId` could be incorrect. For example, if a swapping application derives a wrapped token contract address from the `chainId` *and* a user has changed chains as part of their connection flow the application could cause the user to send funds to the incorrect address when wrapping. This issue has been addressed in PR #749 and is available in updated npm artifacts. There are no known workarounds for this issue. Users are advised to upgrade.\n\n\n",
"fixed_versions": [
"8.0.27-beta"
],
"identifier": "CVE-2023-30543",
"identifiers": [
"CVE-2023-30543",
"GHSA-8pf3-6fgr-3g3g"
],
"not_impacted": "All versions before 6.0.0, all versions starting from 8.0.27-beta.0",
"package_slug": "npm/@web3-react/eip1193",
"pubdate": "2023-04-17",
"solution": "Upgrade to version 8.0.27-beta or above. *Note*: 8.0.27-beta may be an unstable version. Use caution.",
"title": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"urls": [
"https://github.com/Uniswap/web3-react/security/advisories/GHSA-8pf3-6fgr-3g3g",
"https://nvd.nist.gov/vuln/detail/CVE-2023-30543",
"https://github.com/Uniswap/web3-react/pull/749",
"https://github.com/advisories/GHSA-8pf3-6fgr-3g3g"
],
"uuid": "91d8ec63-aa5d-4a87-8cc8-90c7fbb8a53b"
},
{
"affected_range": "\u003e=6.0.0 \u003c=6.2.14||\u003e=8.0.0 \u003c=8.0.29",
"affected_versions": "All versions starting from 6.0.0 up to 6.2.14, all versions starting from 8.0.0 up to 8.0.29",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-362",
"CWE-937"
],
"date": "2023-05-01",
"description": "@web3-react is a framework for building Ethereum Apps . In affected versions the `chainId` may be outdated if the user changes chains as part of the connection flow. This means that the value of `chainId` returned by `useWeb3React()` may be incorrect. In an application, this means that any data derived from `chainId` could be incorrect. For example, if a swapping application derives a wrapped token contract address from the `chainId` *and* a user has changed chains as part of their connection flow the application could cause the user to send funds to the incorrect address when wrapping. This issue has been addressed in PR #749 and is available in updated npm artifacts. There are no known workarounds for this issue. Users are advised to upgrade.\n\n\n",
"fixed_versions": [
"8.2.0"
],
"identifier": "CVE-2023-30543",
"identifiers": [
"CVE-2023-30543",
"GHSA-8pf3-6fgr-3g3g"
],
"not_impacted": "All versions before 6.0.0, all versions after 6.2.14 before 8.0.0, all versions after 8.0.29",
"package_slug": "npm/@web3-react/metamask",
"pubdate": "2023-04-17",
"solution": "Upgrade to version 8.2.0 or above.",
"title": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"urls": [
"https://github.com/Uniswap/web3-react/security/advisories/GHSA-8pf3-6fgr-3g3g",
"https://nvd.nist.gov/vuln/detail/CVE-2023-30543",
"https://github.com/Uniswap/web3-react/pull/749",
"https://github.com/advisories/GHSA-8pf3-6fgr-3g3g"
],
"uuid": "583848dd-80c2-4545-9b12-48e885edee25"
},
{
"affected_range": "\u003e=6.0.0 \u003c=6.2.14||\u003e=7.0.0 \u003c=7.0.2||\u003e=8.0.0 \u003c=8.0.36",
"affected_versions": "All versions starting from 6.0.0 up to 6.2.14, all versions starting from 7.0.0 up to 7.0.2, all versions starting from 8.0.0 up to 8.0.36",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-362",
"CWE-937"
],
"date": "2023-05-01",
"description": "@web3-react is a framework for building Ethereum Apps . In affected versions the `chainId` may be outdated if the user changes chains as part of the connection flow. This means that the value of `chainId` returned by `useWeb3React()` may be incorrect. In an application, this means that any data derived from `chainId` could be incorrect. For example, if a swapping application derives a wrapped token contract address from the `chainId` *and* a user has changed chains as part of their connection flow the application could cause the user to send funds to the incorrect address when wrapping. This issue has been addressed in PR #749 and is available in updated npm artifacts. There are no known workarounds for this issue. Users are advised to upgrade.\n\n\n",
"fixed_versions": [
"8.2.0"
],
"identifier": "CVE-2023-30543",
"identifiers": [
"CVE-2023-30543",
"GHSA-8pf3-6fgr-3g3g"
],
"not_impacted": "All versions before 6.0.0, all versions after 6.2.14 before 7.0.0, all versions after 7.0.2 before 8.0.0, all versions after 8.0.36",
"package_slug": "npm/@web3-react/walletconnect",
"pubdate": "2023-04-17",
"solution": "Upgrade to version 8.2.0 or above.",
"title": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"urls": [
"https://github.com/Uniswap/web3-react/security/advisories/GHSA-8pf3-6fgr-3g3g",
"https://nvd.nist.gov/vuln/detail/CVE-2023-30543",
"https://github.com/Uniswap/web3-react/pull/749",
"https://github.com/advisories/GHSA-8pf3-6fgr-3g3g"
],
"uuid": "756a77c8-0e91-4449-b700-3d1d1afecef5"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.30:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.31:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.32:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.33:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.34:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.35:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.36:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.27:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.28:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.29:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.0:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.1:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.2:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.3:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.4:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.5:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.6:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.7:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.8:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.9:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.10:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.11:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.12:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.13:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.14:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.15:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.16:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.17:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.18:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.19:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.20:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.21:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.22:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.23:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.24:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.25:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:8.0.26:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:7.0.1:alpha0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:7.0.2:alpha0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:7.0.0:alpha0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_walletconnect:*:*:*:*:*:node.js:*:*",
"cpe_name": [],
"versionEndIncluding": "6.2.14",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.27:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.28:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.29:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.0:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.1:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.2:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.3:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.4:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.5:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.6:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.7:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.8:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.9:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.10:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.11:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.12:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.13:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.14:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.15:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.16:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.17:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.18:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.19:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.20:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.21:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.22:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.23:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.24:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.25:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:8.0.26:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_metamask:*:*:*:*:*:node.js:*:*",
"cpe_name": [],
"versionEndIncluding": "6.2.14",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.0:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.1:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.2:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.3:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.4:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.5:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.6:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.7:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.8:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.9:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.10:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.11:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.12:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.13:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.14:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.15:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.16:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.17:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.18:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.19:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.20:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.21:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.22:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.23:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.24:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.25:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:8.0.26:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:7.0.1:alpha0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:7.0.2:alpha0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:7.0.0:alpha0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_eip1193:*:*:*:*:*:node.js:*:*",
"cpe_name": [],
"versionEndIncluding": "6.2.14",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_coinbase-wallet:8.0.22:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_coinbase-wallet:8.0.23:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_coinbase-wallet:8.0.24:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_coinbase-wallet:8.0.25:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_coinbase-wallet:8.0.26:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_coinbase-wallet:8.0.27:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_coinbase-wallet:8.0.28:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_coinbase-wallet:8.0.29:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_coinbase-wallet:8.0.30:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_coinbase-wallet:8.0.31:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_coinbase-wallet:8.0.32:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_coinbase-wallet:8.0.33:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_coinbase-wallet:8.0.34:beta0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_coinbase-wallet:7.0.1:alpha0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_coinbase-wallet:7.0.2:alpha0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_coinbase-wallet:7.0.0:alpha0:*:*:*:node.js:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:uniswap:web3-react_coinbase-wallet:*:*:*:*:*:node.js:*:*",
"cpe_name": [],
"versionEndIncluding": "6.2.14",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2023-30543"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "@web3-react is a framework for building Ethereum Apps . In affected versions the `chainId` may be outdated if the user changes chains as part of the connection flow. This means that the value of `chainId` returned by `useWeb3React()` may be incorrect. In an application, this means that any data derived from `chainId` could be incorrect. For example, if a swapping application derives a wrapped token contract address from the `chainId` *and* a user has changed chains as part of their connection flow the application could cause the user to send funds to the incorrect address when wrapping. This issue has been addressed in PR #749 and is available in updated npm artifacts. There are no known workarounds for this issue. Users are advised to upgrade.\n\n\n"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-362"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/Uniswap/web3-react/pull/749",
"refsource": "MISC",
"tags": [
"Issue Tracking",
"Patch"
],
"url": "https://github.com/Uniswap/web3-react/pull/749"
},
{
"name": "https://github.com/Uniswap/web3-react/security/advisories/GHSA-8pf3-6fgr-3g3g",
"refsource": "MISC",
"tags": [
"Vendor Advisory"
],
"url": "https://github.com/Uniswap/web3-react/security/advisories/GHSA-8pf3-6fgr-3g3g"
}
]
}
},
"impact": {
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.1,
"impactScore": 3.6
}
},
"lastModifiedDate": "2023-05-01T13:16Z",
"publishedDate": "2023-04-17T22:15Z"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…