What is CVE-2023-33964?

CVE-2023-33964 is a high-severity vulnerability in Multiversx Mx-Chain-Go, classified under Improper Input Validation. CVSS score: 8.6/10. Published 2023-05-31.

How severe is CVE-2023-33964?

High severity. CVSS v3 base score is 8.6 out of 10.

Improper input validation in Multiversx Mx-Chain-Go

CVE-2023-33964

mx-chain-go is an implementation of the MultiversX blockchain protocol written in the Go language. Metachain cannot process a cross-shard miniblock. Prior to version 1.4.16, an invalid transaction with the wrong username on metachain is not treated correctly on the metachain transaction processor. This is strictly a processing issue that could have happened on MultiversX chain. If an error like this had occurred, the metachain would have stopped notarizing blocks from the shard chains. The resuming of notarization is possible only after applying a patched binary version. A patch in version 1.4.16 introduces `processIfTxErrorCrossShard` for the metachain transaction processor. There are no known workarounds for this issue.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.006 (43.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N.

Affected products

Multiversx Mx-chain-go — versions < 1.4.16

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2023-33964?: CVE-2023-33964 is a high-severity vulnerability in Multiversx Mx-Chain-Go, classified under Improper Input Validation. CVSS score: 8.6/10. Published 2023-05-31.
How severe is CVE-2023-33964?: High severity. CVSS v3 base score is 8.6 out of 10.