PT-2024-27338 · Evmos · Evmos

Sandoche · Published 2024-06-06 · Updated 2024-10-15 · CVE-2024-37154

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Evmos versions 18.1.0 and earlier

Description The issue affects users who have funds managed via ClawbackVestingAccount, allowing them to delegate tokens that have not yet been vested. This impacts employees and grantees.

Recommendations For versions 18.1.0 and earlier, update to a newer version that includes the fix, as the current version allows premature token delegation. As a temporary workaround, consider containing the information about this vulnerability to minimize the number of users who know about it and can thus exploit it. There is no effective workaround to fix or remediate this issue without a new release.

Exploit

Fix

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

CVE-2024-37154

GHSA-7HRH-V6WP-53VW

GO-2024-2904

Affected Products

Evmos

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37154.json · Exploit
• https://github.com/evmos/evmos/security/advisories/GHSA-7hrh-v6wp-53vw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37154 · Security Note
• https://osv.dev/vulnerability/GO-2024-2904 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7hrh-v6wp-53vw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-37154 · Vendor Advisory
• https://github.com/evmos/evmos · Note
• https://twitter.com/CVEnew/status/1798798238381904066 · Twitter Post
• https://t.me/cvenotify/98188 · Telegram Post
• https://twitter.com/linuxpatch/status/1798809407914221893 · Twitter Post
• https://pkg.go.dev/vuln/GO-2024-2904 · Note