Vulnerability in Openzeppelin Openzeppelin-Contracts
CVE-2023-40014
OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using `ERC2771Context` along with a custom trusted forwarder may see `_msgSender` return `address(0)` in calls that originate from the forwarder with calldata shorter than 20 bytes. This combination of circumstances does not appear to be common, in particular it is not the case for `MinimalForwarder` from OpenZeppelin Contracts, or any deployed forwarder the team is aware of, given that the signer address is appended to all calls that originate from these forwarders. The problem has been patched in v4.9.3.
EPSS: 0.006 (45.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Openzeppelin Openzeppelin-contracts — versions >= 4.0.0, < 4.9.3
- Openzeppelin Openzeppelin_contracts
- Openzeppelin Openzeppelin_contracts-upgradable
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2023-40014?
- CVE-2023-40014 is a medium-severity vulnerability in Openzeppelin Openzeppelin-Contracts, classified under Improper Encoding or Escaping of Output. CVSS score: 5.3/10. Published 2023-08-10.
- How severe is CVE-2023-40014?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2023-40014 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.