CVE-2024-37159 - OpenCVE

Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. This vulnerability allowed a user to create a validator using vested tokens to deposit the self-bond. This vulnerability is fixed in 18.0.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e77709dcb
https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7v

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-06-17T14:03:29.684Z

Updated: 2024-08-02T03:50:55.078Z

Reserved: 2024-06-03T17:29:38.329Z

Link: CVE-2024-37159

Vulnrichment

Updated: 2024-08-02T03:50:55.078Z

NVD

Status : Awaiting Analysis

Published: 2024-06-17T14:15:10.693

Modified: 2024-06-20T12:44:22.977

Link: CVE-2024-37159

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-37159", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-06-03T17:29:38.329Z", "datePublished": "2024-06-17T14:03:29.684Z", "dateUpdated": "2024-08-02T03:50:55.078Z"}, "containers": {"cna": {"title": "Evmos is missing create validator check", "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "lang": "en", "description": "CWE-285: Improper Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7v", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7v"}, {"name": "https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e77709dcb", "tags": ["x_refsource_MISC"], "url": "https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e77709dcb"}], "affected": [{"vendor": "evmos", "product": "evmos", "versions": [{"version": "< 18.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-06-17T14:03:29.684Z"}, "descriptions": [{"lang": "en", "value": "Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. This vulnerability allowed a user to create a validator using vested tokens to deposit the self-bond. This vulnerability is fixed in 18.0.0."}], "source": {"advisory": "GHSA-7279-5h9p-4288", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-15T20:05:01.804774Z", "id": "CVE-2024-37159", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-15T20:05:09.966Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:50:55.078Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7v", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7v"}, {"name": "https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e77709dcb", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e77709dcb"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7v", "name": "https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7v", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e77709dcb", "name": "https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e77709dcb", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:50:55.078Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-37159", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-15T20:05:01.804774Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-15T20:05:05.751Z"}}], "cna": {"title": "Evmos is missing create validator check", "source": {"advisory": "GHSA-7279-5h9p-4288", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "evmos", "product": "evmos", "versions": [{"status": "affected", "version": "< 18.0.0"}]}], "references": [{"url": "https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7v", "name": "https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7v", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e77709dcb", "name": "https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e77709dcb", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. This vulnerability allowed a user to create a validator using vested tokens to deposit the self-bond. This vulnerability is fixed in 18.0.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285: Improper Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-06-17T14:03:29.684Z"}}}, "cveMetadata": {"cveId": "CVE-2024-37159", "state": "PUBLISHED", "dateUpdated": "2024-08-02T03:50:55.078Z", "dateReserved": "2024-06-03T17:29:38.329Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-06-17T14:03:29.684Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}