CVEvulnerability
CVE-2022-25335
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-02-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-863
Description
RigoBlock Dragos through 2022-02-17 lacks the onlyOwner modifier for setMultipleAllowances. This enables token manipulation, as exploited in the wild in February 2022. NOTE: although 2022-02-17 is the vendor's vulnerability announcement date, the vulnerability will not be remediated until a major protocol upgrade occurs.
Affected configurations
• rigoblock drago (<= 2022-02-17)
Related
Weakness · CWE (1)
- CWE-863 Incorrect Authorization weakness
References
- https://etherscan.io/contractdiffchecker?a1=0x876b9ebd725d1fa0b879fcee12560a6453b51dc8 Product, Third Party Advisory
- https://etherscan.io/tx/0x5a6c108d5a729be2011cd47590583a04444d4e7c85cd0427071b968edc3bfc1f Third Party Advisory
- https://raw.globalsecuritydatabase.org/GSD-2022-1000077 Exploit, Third Party Advisory
- https://twitter.com/RigoBlock/status/1494351180713050116 Exploit, Issue Tracking, Third Party Advisory
- https://twitter.com/danielvf/status/1494317265835147272 Exploit, Issue Tracking, Third Party Advisory
- https://etherscan.io/contractdiffchecker?a1=0x876b9ebd725d1fa0b879fcee12560a6453b51dc8 Product, Third Party Advisory
- https://etherscan.io/tx/0x5a6c108d5a729be2011cd47590583a04444d4e7c85cd0427071b968edc3bfc1f Third Party Advisory
- https://raw.globalsecuritydatabase.org/GSD-2022-1000077 Exploit, Third Party Advisory
- https://twitter.com/RigoBlock/status/1494351180713050116 Exploit, Issue Tracking, Third Party Advisory
- https://twitter.com/danielvf/status/1494317265835147272 Exploit, Issue Tracking, Third Party Advisory