CVE-2022-35916
Last modified
CVE-2022-35916 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. OpenZeppelin Contracts is a library for secure smart contract development. Contracts using the cross chain utilities for Arbitrum L2, `CrossChainEnabledArbitrumL2` or `LibArbitrumL2`, will classify direct interactions of externally owned accounts (EOAs) as cross chain calls, even though they are not started on L1. EPSS estimates a 0.47% chance of exploitation in the next 30 days.
Description
OpenZeppelin Contracts is a library for secure smart contract development. Contracts using the cross chain utilities for Arbitrum L2, `CrossChainEnabledArbitrumL2` or `LibArbitrumL2`, will classify direct interactions of externally owned accounts (EOAs) as cross chain calls, even though they are not started on L1. This issue has been patched in v4.7.2. Users are advised to upgrade. There are no known workarounds for this issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Openzeppelin | Contracts | >= 4.6.0, < 4.7.2 |
| Openzeppelin | Contracts Upgradeable | >= 4.6.0, < 4.7.2 |
References
- https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3578Patch, Third Party Advisory
- https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3578Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-35916?
How severe is CVE-2022-35916?
How do I fix CVE-2022-35916?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-35910In Jellyfin before 10.8, stored XSS allows theft of an admin…5.4
- CVE-2022-35911On Patlite NH-FB series devices through 1.46, remote attacke…7.5
- CVE-2022-35912In grails-databinding in Grails before 3.3.15, 4.x before 4.…9.8
- CVE-2022-35913Samourai Wallet Stonewallx2 0.99.98e allows a denial of serv…4.3
- CVE-2022-35914/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed m…9.8
- CVE-2022-35915OpenZeppelin Contracts is a library for secure smart contrac…5.3
- CVE-2022-35917Solana Pay is a protocol and set of reference implementation…5.3
- CVE-2022-35918Streamlit is a data oriented application development framewo…6.5
- CVE-2022-35919MinIO is a High Performance Object Storage released under GN…2.7
- CVE-2022-3592A symlink following vulnerability was found in Samba, where …6.5
- CVE-2022-35920Sanic is an opensource python web server/framework. Affected…7.5
- CVE-2022-35921fof/byobu is a private discussions extension for Flarum foru…4.3
Are you affected by CVE-2022-35916?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST