PT-2023-20679 · Openzeppelin · Openzeppelin Contracts

Frangio · Publicado 2023-03-03 · Atualizado 2023-03-10 · CVE-2023-26488

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenZeppelin Contracts versions prior to 4.8.2

Description The ERC721Consecutive contract, designed for minting NFTs in batches, does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the balance as reported by balanceOf. The issue exclusively presents with batches of size 1.

Recommendations For versions prior to 4.8.2, update to version 4.8.2 to resolve the issue. As a temporary workaround, consider restricting the use of the ERC721Consecutive contract for batches of size 1 until the update is applied.

Exploit

Correção

Enumeração de Fraquezas

CWE-682

Identificadores relacionados

CVE-2023-26488

GHSA-878M-3G6Q-594Q

Produtos afetados

Openzeppelin Contracts

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26488.json · Exploit
• https://github.com/OpenZeppelin/openzeppelin-contracts · Nota
• https://github.com/OpenZeppelin/openzeppelin-contracts/commit/167bf67ed3907f4a674043496019fa346cee7705 · Correção
• https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.8.2 · Nota
• https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-878m-3g6q-594q · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-26488 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-878m-3g6q-594q · Aviso do Fabricante
• https://t.me/cvenotify/45493 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-26488 · Aviso do Fabricante
• https://t.me/cibsecurity/59405 · Publicação no Telegram