CVE-2022-25335

Description

RigoBlock Dragos through 2022-02-17 lacks the onlyOwner modifier for setMultipleAllowances. This enables token manipulation, as exploited in the wild in February 2022. NOTE: although 2022-02-17 is the vendor's vulnerability announcement date, the vulnerability will not be remediated until a major protocol upgrade occurs.

Weakness classification

• CWE-863: Incorrect Authorization

Primary references

• cve@mitre.org — Product, Third Party Advisory
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Exploit, Third Party Advisory
• cve@mitre.org — Exploit, Issue Tracking, Third Party Advisory
• cve@mitre.org — Exploit, Issue Tracking, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Product, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Third Party Advisory