PT-2022-23150 · Elrond · Elrond-Go

Iulianpascalau · Published 2022-09-06 · Updated 2024-08-21 · CVE-2022-36061

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Elrond go versions prior to 1.3.35

Description The issue concerns read-only calls between contracts in the Elrond Network protocol, which can generate smart contract results and alter the state of the called contract as if the call was not made in read-only mode. This can lead to unintended effects not designed by the original smart contract programmers.

Recommendations For versions prior to 1.3.35, update to version 1.3.35 or higher to resolve the issue. At the moment, there are no known workarounds for this issue.

Exploit

Fix

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

CVE-2022-36061

GHSA-MV8X-668M-53FG

GO-2022-0971

Affected Products

Elrond-Go

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36061.json · Exploit
• 🔥 https://github.com/ElrondNetwork/elrond-go/blob/8e402fa6d7e91e779980122d3798b2bf50892945/integrationTests/vm/txsFee/asyncESDT_test.go#L452 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-36061 · Security Note
• https://osv.dev/vulnerability/GHSA-mv8x-668m-53fg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36061 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0971 · Vendor Advisory
• https://github.com/ElrondNetwork/elrond-go · Note
• https://github.com/ElrondNetwork/elrond-go/releases/tag/v1.3.35 · Note
• https://github.com/ElrondNetwork/elrond-go/security/advisories/GHSA-mv8x-668m-53fg · Note
• https://t.me/cibsecurity/49377 · Telegram Post