CVE-2021-39167: critical vulnerability in openzeppelin-contracts
TimelockController vulnerability in OpenZeppelin Contracts
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 10epss 1.6%
OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role from accounts not strictly under the team's control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
OpenZeppelin · openzeppelin-contractsRelated CVEs — openzeppelin-contracts
In the same product, most dangerous first.
CVE-2021-41264CRITICALUUPSUpgradeable vulnerability in OpenZeppelin ContractsEPSS 1.5%CVE-2023-30541MEDIUMTransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contractsEPSS 0.8%CVE-2022-35915MEDIUMUnbounded gas consumption in @openzeppelin/contractsEPSS 0.8%CVE-2022-31198HIGHGovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contractsEPSS 0.8%CVE-2022-31170HIGH OpenZeppelin Contracts's ERC165Checker may revert instead of returning falseEPSS 0.8%CVE-2024-27094MEDIUMOpenZeppelin Contracts base64 encoding may read from potentially dirty memoryEPSS 0.8%