CVE-2023-40014 — Improper Encoding or Escaping of Output in Contracts

CWE-116 — Improper Encoding or Escaping of Output4 documents3 sources
Severity
5.3MEDIUMNVD
EPSS
0.5%
top 34.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Openzeppelin ContractsOpenzeppelin Contracts-upgradableOpenzeppelin Contracts+2 more
Timeline
PublishedAug 10
Latest updateAug 11

Description

OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using `ERC2771Context` along with a custom trusted forwarder may see `_msgSender` return `address(0)` in calls that originate from the forwarder with calldata shorter than 20 bytes. This combination of circumstances does not appear to be common, in particular it is not the case for `MinimalForwarder` from OpenZeppelin Contracts, or any deployed forwarder the …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages5 packages

▶npmopenzeppelin/contracts4.0.0 — 4.9.3
▶CVEListV5openzeppelin/openzeppelin-contracts>= 4.0.0, < 4.9.3

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
OpenZeppelin Contracts vulnerable to Improper Escaping of Output↗2023-08-11
▶
OSV
OpenZeppelin Contracts vulnerable to Improper Escaping of Output↗2023-08-11
▶
OSV
CVE-2023-40014: OpenZeppelin Contracts is a library for secure smart contract development↗2023-08-10
▶