CVE-2022-25335
published 2022-02-18CVE-2022-25335: RigoBlock Dragos through 2022-02-17 lacks the onlyOwner modifier for setMultipleAllowances. This enables token manipulation, as exploited in the wild in…
PriorityP274high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
ITWVulnCheck KEV
Exploited in the wild
EPSS
1.26%
65.9th percentile
RigoBlock Dragos through 2022-02-17 lacks the onlyOwner modifier for setMultipleAllowances. This enables token manipulation, as exploited in the wild in February 2022. NOTE: although 2022-02-17 is the vendor's vulnerability announcement date, the vulnerability will not be remediated until a major protocol upgrade occurs.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| rigoblock | drago | <= 2022-02-17 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
vulncheck7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7c5g-cjm9-2jm4: RigoBlock Dragos through 2022-02-17 lacks the onlyOwner modifier for setMultipleAllowances
ghsa_unreviewed·2022-02-19
CVE-2022-25335 [HIGH] CWE-732 GHSA-7c5g-cjm9-2jm4: RigoBlock Dragos through 2022-02-17 lacks the onlyOwner modifier for setMultipleAllowances
RigoBlock Dragos through 2022-02-17 lacks the onlyOwner modifier for setMultipleAllowances. This enables token manipulation, as exploited in the wild in February 2022. NOTE: although 2022-02-17 is the vendor's vulnerability announcement date, the vulnerability will not be remediated until a major protocol upgrade occurs.
VulnCheck
rigoblock drago Incorrect Authorization
vulncheck·2022·CVSS 7.5
CVE-2022-25335 [HIGH] rigoblock drago Incorrect Authorization
rigoblock drago Incorrect Authorization
RigoBlock Dragos through 2022-02-17 lacks the onlyOwner modifier for setMultipleAllowances. This enables token manipulation, as exploited in the wild in February 2022. NOTE: although 2022-02-17 is the vendor's vulnerability announcement date, the vulnerability will not be remediated until a major protocol upgrade occurs.
Affected: rigoblock drago
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.cve.org/CVERecord?id=CVE-2022-25335
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://etherscan.io/contractdiffchecker?a1=0x876b9ebd725d1fa0b879fcee12560a6453b51dc8https://etherscan.io/tx/0x5a6c108d5a729be2011cd47590583a04444d4e7c85cd0427071b968edc3bfc1fhttps://raw.globalsecuritydatabase.org/GSD-2022-1000077https://twitter.com/RigoBlock/status/1494351180713050116https://twitter.com/danielvf/status/1494317265835147272https://etherscan.io/contractdiffchecker?a1=0x876b9ebd725d1fa0b879fcee12560a6453b51dc8https://etherscan.io/tx/0x5a6c108d5a729be2011cd47590583a04444d4e7c85cd0427071b968edc3bfc1fhttps://raw.globalsecuritydatabase.org/GSD-2022-1000077https://twitter.com/RigoBlock/status/1494351180713050116https://twitter.com/danielvf/status/1494317265835147272
2022-02-18
Published
Exploited in the wild