Lucene search
Veracode Vulnerability DatabaseVERACODE:36470HistoryJul 25, 2022 - 9:15 a.m.
Improper Input Validation
2022-07-2509:15:55
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
12
0.001 Low
EPSS
Percentile
26.9%
@openzeppelin/contracts and @openzeppelin/contracts-upgradeable are vulnerable to improper input validation. The vulnerability exists because an incorrect assumption about Solidity 0.8’s abi.decode allows ERC165Checker to revert instead of returning false via a specifically crafted input request.
References
github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/5e9bccb282ee8f3c9c4abaccc74b40b9d34ccffa
github.com/OpenZeppelin/openzeppelin-contracts/commit/212de08e7f47b9836acca681ce0c9c6f91fe78aa
github.com/OpenZeppelin/openzeppelin-contracts/pull/3552
github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-qh9x-gcfh-pcrw
Related
prion
prion
Authentication flaw
2022-07-22 04:15:00
osv
osv
CVE-2022-31170
2022-07-22 04:15:14
OpenZeppelin Contracts's ERC165Checker may revert instead of returning false
2022-07-21 22:33:01
cvelist
cvelist
cve
cve
CVE-2022-31170
2022-07-22 04:15:14
github
github
OpenZeppelin Contracts's ERC165Checker may revert instead of returning false
2022-07-21 22:33:01
veracode
veracode
Authentication Bypass
2022-07-22 06:33:33
nvd
nvd
CVE-2022-31170
2022-07-22 04:15:14