CVE Feed

    Dashboard / CVE / CVE-2021-41264

    CVE-2021-41264

    OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using `UUPSUpgradeable` may be vulnerable to an attack affecting uninitialized implementation contracts. A fix is included in version 4.3.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`. For users unable to upgrade; initialize implementation contracts using `UUPSUpgradeable` by invoking the initializer function (usually called `initialize`). An example is provided [in the forum](https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301).

    Published:Nov 12, 2021
    Last Modified:Nov 21, 2024
    EPS:Nov 12, 2021
    EPSS Score:0.00641
    CVSS Score:9.8

    Affected Products

    Vendor
    Openzeppelin
    Product
    Contracts

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-665 Improper Initialization

    Related CVEs

    CVE-2024-45304 (CVSS 5.3) — Cairo-Contracts are OpenZeppelin Contracts written in Cairo for Starknet, a decentralized ZK Rollup. This vuln…
    CVE-2024-27094 (CVSS 6.5) — OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encode…
    CVE-2023-49798 (CVSS 5.9) — OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch…
    CVE-2023-34459 (CVSS 5.3) — OpenZeppelin Contracts is a library for smart contract development. Starting in version 4.7.0 and prior to ver…
    CVE-2023-34234 (CVSS 5.3) — OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposa…
    CVE-2023-30541 (CVSS 5.3) — OpenZeppelin Contracts is a library for secure smart contract development. A function in the implementation co…
    CVE-2023-30542 (CVSS 6.8) — OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`…
    CVE-2023-26488 (CVSS 6.5) — OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract desi…
    CVE-2023-23940 (CVSS 6.4) — OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for Stark…
    CVE-2022-39384 (CVSS 5.6) — OpenZeppelin Contracts is a library for secure smart contract development. Before version 4.4.1 but after 3.2.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High