CVE Vulnerability

CVE-2022-35915

OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 `supportsInterface` query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost. The issue has been fixed in v4.7.2. Users are advised to upgrade. There are no known workarounds for this issue.

5.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3587 Patch Third Party Advisory
https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-7grf-83vw-6f5x Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:openzeppelin:openzeppelin-solidity:*:*:*:*:*:node.js:*:*
cpe:2.3:a:openzeppelin:contracts:*:*:*:*:*:node.js:*:*
cpe:2.3:a:openzeppelin:openzeppelin-eth:*:*:*:*:*:node.js:*:*
cpe:2.3:a:openzeppelin:contracts_upgradeable:*:*:*:*:*:node.js:*:*
Information

Published : 2022-08-01 09:15

Updated : 2022-12-06 07:51

NVD link : CVE-2022-35915

Mitre link : CVE-2022-35915

Products Affected
No products.
CWE
CWE-400