CVE-2022-24738

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2022-24738

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24738.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-24738

Aliases

Published

2022-03-07T21:30:13Z

Modified

2025-12-04T10:17:28.419025Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Account compromise in Evmos

Details

Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain unclaimed funds from user addresses. To do this an attacker must create a new chain which does not enforce signature verification and connects it to the target evmos instance. The attacker can use this joined chain to transfer unclaimed funds. Users are advised to upgrade. There are no known workarounds for this issue.

Database specific

{
    "cwe_ids": [
        "CWE-287"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24738.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/evmos/evmos

Affected ranges

Type: GIT
Repo: https://github.com/evmos/evmos
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

28870258d4ee9f1b8aeef5eba891681f89348f71

Fixed

39f0f27621fcee44a4e5538e0fd37f16899e610e

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24738.json"

Git / github.com/tharsis/evmos

Affected ranges

Type

GIT

Repo

https://github.com/tharsis/evmos

Events

Introduced

Fixed

39f0f27621fcee44a4e5538e0fd37f16899e610e

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.1"
        }
    ]
}

Affected versions

v2.*

v2.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24738.json"