CVE-2022-35916: openzeppelin contracts +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2022-35916

CVSS 5.3 · Medium EPSS 0,58%

Kerentanan Incorrect Resource Transfer Between Spheres pada openzeppelin contracts, openzeppelin contracts upgradeable. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

OpenZeppelin Contracts is a library for secure smart contract development. Contracts using the cross chain utilities for Arbitrum L2, `CrossChainEnabledArbitrumL2` or `LibArbitrumL2`, will classify direct interactions of externally owned accounts (EOAs) as cross chain calls, even though they are not started on L1. This issue has been patched in v4.7.2. Users are advised to upgrade. There are no known workarounds for this issue.

Rincian

Terbit di NVD: 1 Agustus 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-669: Incorrect Resource Transfer Between Spheres
EPSS (30 hari): 0,58% peluang dieksploitasi; lebih tinggi dari 46,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
openzeppelin	contracts	Versi 4.6.0 hingga sebelum 4.7.2
openzeppelin	contracts upgradeable	Versi 4.6.0 hingga sebelum 4.7.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3578 patch · advisory pihak ketiga
https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9j3m-g383-29qr advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.