{"id":"CVE-2024-37159","published":"2024-06-17T14:03:29Z","modified":"2024-08-02T03:50:55Z","title":"Evmos is missing create validator check","vendor":"evmos","product":"evmos","tier":"tail","description":{"text":"Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. This vulnerability allowed a user to create a validator using vested tokens to deposit the self-bond. This vulnerability is fixed in 18.0.0.","provenance":"source","from":"CVE.org"},"cvss":{"score":3.5,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00313,"percentile":0.24137,"provenance":"source"},"cwes":[{"id":"CWE-285","name":"Improper Authorization"}],"references":[{"url":"https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7v","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/evmos/evmos/commit/b2a09ca66613d8b04decd3f2dcba8e1e77709dcb","tags":["x_refsource_MISC"]}],"priority":{"score":7.3,"factors":[{"name":"EPSS percentile","points":4.83},{"name":"CVSS severity","points":2.45}]},"vendorSlug":"evmos","affectedVersions":[{"vendor":"evmos","product":"evmos","versions":["< 18.0.0"]}],"affected":[{"ecosystem":"Go","package":"github.com/evmos/evmos","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-2891","GO-2024-2926","GO-2024-2927"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/evmos/evmos/v2","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-2891","GO-2024-2926","GO-2024-2927"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/evmos/evmos/v3","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-2891","GO-2024-2926","GO-2024-2927"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/evmos/evmos/v4","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-2891","GO-2024-2926","GO-2024-2927"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/evmos/evmos/v5","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-2891","GO-2024-2926","GO-2024-2927"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/evmos/evmos/v6","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-2891","GO-2024-2926","GO-2024-2927"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/evmos/evmos/v7","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-2891","GO-2024-2926","GO-2024-2927"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/evmos/evmos/v8","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-2891","GO-2024-2926","GO-2024-2927"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/evmos/evmos/v9","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-2891","GO-2024-2926","GO-2024-2927"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/evmos/evmos/v10","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-2891","GO-2024-2926","GO-2024-2927"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-36471","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-evmos-cve-2024-32873","parents":[{"from":"CVE-2024-32873","to":"CVE-2024-37159","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-pxv8-qhrh-jc7v","via":"reference","url":"https://github.com/evmos/evmos/security/advisories/GHSA-pxv8-qhrh-jc7v"}]}]}}