Vulnerability Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/vulnerabilities/45825?format=api",
    "vulnerability_id": "VCID-n62w-34wv-rbdn",
    "summary": "Improper Encoding or Escaping of Output\nOpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using `ERC2771Context` along with a custom trusted forwarder may see `_msgSender` return `address(0)` in calls that originate from the forwarder with calldata shorter than 20 bytes. This combination of circumstances does not appear to be common, in particular it is not the case for `MinimalForwarder` from OpenZeppelin Contracts, or any deployed forwarder the team is aware of, given that the signer address is appended to all calls that originate from these forwarders. The problem has been patched in v4.9.3.",
    "aliases": [
        {
            "alias": "CVE-2023-40014"
        },
        {
            "alias": "GHSA-g4vp-m682-qqmp"
        }
    ],
    "fixed_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/66536?format=api",
            "purl": "pkg:npm/%40openzeppelin/contracts@4.9.3",
            "is_vulnerable": false,
            "affected_by_vulnerabilities": [],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/%2540openzeppelin/contracts@4.9.3"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/66541?format=api",
            "purl": "pkg:npm/%40openzeppelin/contracts-upgradeable@4.9.3",
            "is_vulnerable": false,
            "affected_by_vulnerabilities": [],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/%2540openzeppelin/contracts-upgradeable@4.9.3"
        }
    ],
    "affected_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/58806?format=api",
            "purl": "pkg:npm/%40openzeppelin/contracts@4.0.0",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-n62w-34wv-rbdn"
                },
                {
                    "vulnerability": "VCID-nkwc-fgjc-kqbt"
                },
                {
                    "vulnerability": "VCID-xpnm-mbrk-mugy"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/%2540openzeppelin/contracts@4.0.0"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/58831?format=api",
            "purl": "pkg:npm/%40openzeppelin/contracts-upgradeable@4.0.0",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-4c19-crxp-93fh"
                },
                {
                    "vulnerability": "VCID-n62w-34wv-rbdn"
                },
                {
                    "vulnerability": "VCID-nkwc-fgjc-kqbt"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/%2540openzeppelin/contracts-upgradeable@4.0.0"
        }
    ],
    "references": [
        {
            "reference_url": "https://github.com/OpenZeppelin/openzeppelin-contracts/blob/v4.9.3/CHANGELOG.md",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/OpenZeppelin/openzeppelin-contracts/blob/v4.9.3/CHANGELOG.md"
        },
        {
            "reference_url": "https://github.com/OpenZeppelin/openzeppelin-contracts/commit/9445f96223041abf2bf08daa56f8da50b674cbcd",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/OpenZeppelin/openzeppelin-contracts/commit/9445f96223041abf2bf08daa56f8da50b674cbcd"
        },
        {
            "reference_url": "https://github.com/OpenZeppelin/openzeppelin-contracts/commit/e4435eed757d4309436b1e06608e97b6d6e2fdb5",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/OpenZeppelin/openzeppelin-contracts/commit/e4435eed757d4309436b1e06608e97b6d6e2fdb5"
        },
        {
            "reference_url": "https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4481",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4481"
        },
        {
            "reference_url": "https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4484",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4484"
        },
        {
            "reference_url": "https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.9.3",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v4.9.3"
        },
        {
            "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40014",
            "reference_id": "CVE-2023-40014",
            "reference_type": "",
            "scores": [],
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40014"
        },
        {
            "reference_url": "https://github.com/advisories/GHSA-g4vp-m682-qqmp",
            "reference_id": "GHSA-g4vp-m682-qqmp",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/advisories/GHSA-g4vp-m682-qqmp"
        },
        {
            "reference_url": "https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-g4vp-m682-qqmp",
            "reference_id": "GHSA-g4vp-m682-qqmp",
            "reference_type": "",
            "scores": [],
            "url": "https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-g4vp-m682-qqmp"
        }
    ],
    "weaknesses": [
        {
            "cwe_id": 1035,
            "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities",
            "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."
        },
        {
            "cwe_id": 116,
            "name": "Improper Encoding or Escaping of Output",
            "description": "The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved."
        },
        {
            "cwe_id": 937,
            "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities",
            "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."
        }
    ],
    "exploits": [],
    "severity_range_score": null,
    "exploitability": null,
    "weighted_severity": null,
    "risk_score": null,
    "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-n62w-34wv-rbdn"
}