PT-2021-10409 · Icvo · Icvo

Published 2021-09-07 · Updated 2021-09-14 · CVE-2020-19768

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: ICVO version 1.0

Description: A lack of target address verification in the selfdestructs() function allows attackers to steal tokens from victim users via a crafted script.

Recommendations: For version 1.0, consider disabling the selfdestructs() function until a patch is available to prevent token theft. Restrict access to the selfdestructs() function to minimize the risk of exploitation. Avoid using crafted scripts that could exploit the lack of target address verification in the selfdestructs() function until the issue is resolved.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2020-19768

Affected Products

Icvo

References · 5

• 🔥 https://github.com/OSUPlayer/CVEs/blob/master/Suicidal/2019-07-09-02.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-19768 · Security Note
• https://osv.dev/vulnerability/CVE-2020-19768 · Vendor Advisory
• https://t.me/cibsecurity/28408 · Telegram Post
• https://t.me/cvenotify/20833 · Telegram Post