CVE-2021-39168
Critical
Description
OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with the executor role to escalate privileges. Further details about the vulnerability will be disclosed at a later date. As a workaround revoke the executor role from accounts not strictly under the team's control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.
SeverityCritical
CVSS10.0
Exploit probability—
ProductOpenzeppelin Contracts
PublishedAug 27, 2021
First seenAug 27, 2021
Weakness typeCWE-269Improper privilege management
How to fix
Update
- openzeppelin contracts3.4.2, 4.3.1 or later
- @openzeppelin/contracts-upgradeable4.3.1, 3.4.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openzeppelin contracts | 3.3.0 ≤ v < 3.4.2, 4.0.0 ≤ v < 4.3.1 | 3.4.2, 4.3.1 |
| @openzeppelin/contracts-upgradeablenpm | 4.0.0 ≤ v < 4.3.1, 3.3.0 ≤ v < 3.4.2 | 4.3.1, 3.4.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.