CVE-2023-49798
MEDIUM
5,9
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: none
Description
AI Translation Available
OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch to the 4.9 branch caused a line duplication. In the version of `Multicall.sol` released in `@openzeppelin/[email protected]` and `@openzeppelin/[email protected]`, all subcalls are executed twice. Concretely, this exposes a user to unintentionally duplicate operations like asset transfers. The duplicated delegatecall was removed in version 4.9.5. The 4.9.4 version is marked as deprecated. Users are advised to upgrade. There are no known workarounds for this issue.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0049
Percentile
0,7th
Updated
EPSS Score Trend (Last 90 Days)
670
Always-Incorrect Control Flow Implementation
DraftCommon Consequences
Security Scopes Affected:
Other
Potential Impacts:
Other
Alter Execution Logic
Applicable Platforms
All platforms may be affected
Application
Contracts by Openzeppelin
CPE Identifier
View Detailed Analysis
cpe:2.3:a:openzeppelin:contracts:4.9.4:*:*:*:*:node.js:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Contracts Upgradeable by Openzeppelin
CPE Identifier
View Detailed Analysis
cpe:2.3:a:openzeppelin:contracts_upgradeable:4.9.4:*:*:*:*:node.js:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://github.com/OpenZeppelin/openzeppelin-contracts/commit/88ac712e06832bce7…
https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA…
https://github.com/OpenZeppelin/openzeppelin-contracts/commit/88ac712e06832bce7…
https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA…