Authentication Bypass

2022-07-2206:33:33

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

26.9%

JSON

@openzeppelin/contractsvulnerable to improper input validation. The vulnerability exists in the ERC165Checker function in ERC165Checker.sol and ERC165CheckerUpgradeable function in ERC165CheckerUpgradeable.sol due to the incorrect assumption about abi.decode which allows a malicious user to pass an invalid signature to the system and become authenticated.

CPENameOperatorVersion
@openzeppelin/contracts-upgradeablele4.7.0
@openzeppelin/contractsle4.7.0
@openzeppelin/contractsle4.4.1
@openzeppelin/contracts-upgradeableeq4.4.1
@openzeppelin/contracts-upgradeablele4.7.0
@openzeppelin/contractsle4.7.0
@openzeppelin/contractsle4.4.1
@openzeppelin/contracts-upgradeableeq4.4.1

Name	Operator	Version
@openzeppelin/contracts-upgradeable	le	4.7.0
@openzeppelin/contracts	le	4.7.0
@openzeppelin/contracts	le	4.4.1
@openzeppelin/contracts-upgradeable	eq	4.4.1
@openzeppelin/contracts-upgradeable	le	4.7.0
@openzeppelin/contracts	le	4.7.0
@openzeppelin/contracts	le	4.4.1
@openzeppelin/contracts-upgradeable	eq	4.4.1