CVE-2022-31153

Katalog CVE

CVSS 6.5 · Medium EPSS 1,5%

Kerentanan Improper Control of a Resource Through its Lifetime pada openzeppelin contracts. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup. Version 0.2.0 is vulnerable to an error that renders account contracts unusable on live networks. This issue affects all accounts (vanilla and ethereum flavors) in the v0.2.0 release of OpenZeppelin Contracts for Cairo, which are not whitelisted on StarkNet mainnet. Only goerli deployments of v0.2.0 accounts are affected. This faulty behavior is not observed in StarkNet's testing framework. This bug has been patched in v0.2.1.

Rincian

Terbit di NVD

15 Juli 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-664: Improper Control of a Resource Through its Lifetime
CWE-863: Incorrect Authorization

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 72,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OpenZeppelin/cairo-contracts/commit/2cd60279c3332285d47edf9ee3888b71257acdc9 patch · advisory pihak ketiga
• https://github.com/OpenZeppelin/cairo-contracts/pull/387 patch · advisory pihak ketiga
• https://github.com/OpenZeppelin/cairo-contracts/blob/release-0.2.0/src/openzeppelin/account/library.cairo#L203 exploit · advisory pihak ketiga
• https://github.com/OpenZeppelin/cairo-contracts/issues/386 exploit · issue tracking · advisory pihak ketiga
• https://github.com/OpenZeppelin/cairo-contracts/releases/tag/v0.2.1 release notes · advisory pihak ketiga
• https://github.com/OpenZeppelin/cairo-contracts/security/advisories/GHSA-8mjr-jr5h-q2xr advisory pihak ketiga