CVE Vulnerability

CVE-2021-39167

OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role from accounts not strictly under the team's control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.

7.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/CHANGELOG.md#431 Patch Release Notes
https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-fg47-3c2x-m2wr Third Party Advisory
https://github.com/OpenZeppelin/openzeppelin-contracts/commit/cec4f2ef57495d8b1742d62846da212515d99dd5 Patch Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:openzeppelin:contracts:*:*:*:*:*:node.js:*:*
cpe:2.3:a:openzeppelin:contracts:*:*:*:*:*:node.js:*:*
Information

Published : 2021-08-27 12:15

Updated : 2021-09-01 06:10

NVD link : CVE-2021-39167

Mitre link : CVE-2021-39167

Products Affected
No products.
CWE
CWE-269