PT-2023-20679 · Openzeppelin · Openzeppelin Contracts

Frangio · CVE-2023-26488 · Published 2023-03-03 · Updated 2023-03-10

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenZeppelin Contracts versions prior to 4.8.2

Description The ERC721Consecutive contract, designed for minting NFTs in batches, does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the balance as reported by balanceOf. The issue exclusively presents with batches of size 1.

Recommendations For versions prior to 4.8.2, update to version 4.8.2 to resolve the issue. As a temporary workaround, consider restricting the use of the ERC721Consecutive contract for batches of size 1 until the update is applied.

Exploit

Fix

Weakness Enumeration

CWE-682

Related Identifiers

CVE-2023-26488

GHSA-878M-3G6Q-594Q

Affected Products

Openzeppelin Contracts

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26488.json · Exploit
• https://github.com/OpenZeppelin/openzeppelin-contracts/commit/167bf67ed3907f4a674043496019fa346cee7705 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-26488 · Security Note
• https://osv.dev/vulnerability/GHSA-878m-3g6q-594q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26488 · Vendor Advisory
• https://github.com/OpenZeppelin/openzeppelin-contracts · Note
• https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.8.2 · Note
• https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-878m-3g6q-594q · Note
• https://t.me/cvenotify/45493 · Telegram Post
• https://t.me/cibsecurity/59405 · Telegram Post