6.5
CVE-2023-26488
- EPSS 0.71%
- Veröffentlicht 03.03.2023 22:15:09
- Zuletzt bearbeitet 21.11.2024 07:51:37
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
LoginOpenZeppelin Contracts contains Incorrect Calculation
OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the balance as reported by `balanceOf`. The issue exclusively presents with batches of size 1. The issue has been patched in 4.8.2.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Openzeppelin ≫ Contracts SwPlatformnode.js Version >= 4.8.0 < 4.8.2
Openzeppelin ≫ Contracts Upgradeable SwPlatformnode.js Version >= 4.8.0 < 4.8.2
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.71% | 0.488 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
|
| security-advisories@github.com | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
|
CWE-682 Incorrect Calculation
The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
https://github.com/OpenZeppelin/openzeppelin-contracts/commit/167bf67ed3907f4a674043496019fa346cee7705
https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.8.2
https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-878m-3g6q-594q