CVE-2023-40014

Katalog CVE

CVSS 5.3 · Medium EPSS 0,74%

Kerentanan Improper Encoding or Escaping of Output pada openzeppelin contracts, openzeppelin contracts-upgradable. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using `ERC2771Context` along with a custom trusted forwarder may see `_msgSender` return `address(0)` in calls that originate from the forwarder with calldata shorter than 20 bytes. This combination of circumstances does not appear to be common, in particular it is not the case for `MinimalForwarder` from OpenZeppelin Contracts, or any deployed forwarder the team is aware of, given that the signer address is appended to all calls that originate from these forwarders. The problem has been patched in v4.9.3.

Rincian

Terbit di NVD

10 Agustus 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-116: Improper Encoding or Escaping of Output

EPSS (30 hari)

0,74% peluang dieksploitasi; lebih tinggi dari 53,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4481 patch · advisory vendor
• https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4484 patch · advisory vendor
• https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-g4vp-m682-qqmp advisory vendor
• https://github.com/OpenZeppelin/openzeppelin-contracts/commit/9445f96223041abf2bf08daa56f8da50b674cbcd patch
• https://github.com/OpenZeppelin/openzeppelin-contracts/commit/e4435eed757d4309436b1e06608e97b6d6e2fdb5 patch
• https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.9.3 release notes