TimelockController vulnerability in OpenZeppelin Contracts (OpenZeppelin openzeppelin-contracts)
At a glance
- Source
- NVD
- EPSS
- EPSS 1.59 % · percentile 76 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Modified
Description
OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role from accounts not strictly under the team's control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.
Weaknesses (CWE)
- CWE-269 — Improper Privilege Management
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | GitHub_M |
| CVSS 3.1 | CRITICAL 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-fg47-3c2x-m2wr — TimelockController vulnerability in OpenZeppelin Contracts
European references
- ENISA EUVD · EUVD-2021-1700
- GCVE · GCVE-0-2021-39167
Affected configurations (NVD CPE)
cpe:2.3:a:openzeppelin:contracts:*:*:*:*:*:node.js:*:*≥ 3.3.0 < 3.4.2cpe:2.3:a:openzeppelin:contracts:*:*:*:*:*:node.js:*:*≥ 4.0.0 < 4.3.1
Affected products
| Product | Versions |
|---|---|
| OpenZeppelin · openzeppelin-contracts | affected >=4.0.0, < 4.3.1 ; affected >=3.3.0, < 3.4.2 ; affected >= 3.3.0-solc-0.7, < 3.4.2-solc-0.7 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |