Vulnerability · Published Feb 18, 2022 · Assigned by mitre
CVE-2022-25335
High 7.5
In plain English
A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).
Severity (CVSS NVD)7.5High
Exploit odds (30 days)1.3%top 29.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
RigoBlock Dragos through 2022-02-17 lacks the onlyOwner modifier for setMultipleAllowances. This enables token manipulation, as exploited in the wild in February 2022. NOTE: although 2022-02-17 is the vendor's vulnerability announcement date, the vulnerability will not be remediated until a major protocol upgrade occurs.
Affected products (as reported)
References
- https://twitter.com/RigoBlock/status/1494351180713050116 x_refsource_MISC
- https://etherscan.io/tx/0x5a6c108d5a729be2011cd47590583a04444d4e7c85cd0427071b968edc3bfc1f x_refsource_MISC
- https://etherscan.io/contractdiffchecker?a1=0x876b9ebd725d1fa0b879fcee12560a6453b51dc8 x_refsource_MISC
- https://twitter.com/danielvf/status/1494317265835147272 x_refsource_MISC
- https://raw.globalsecuritydatabase.org/GSD-2022-1000077 x_refsource_MISC