CVE-2022-25335

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

RigoBlock Dragos through 2022-02-17 lacks the onlyOwner modifier for setMultipleAllowances. This enables token manipulation, as exploited in the wild in February 2022. NOTE: although 2022-02-17 is the vendor's vulnerability announcement date, the vulnerability will not be remediated until a major protocol upgrade occurs.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://etherscan.io/contractdiffchecker?a1=0x876b9ebd725d1fa0b879fcee12560a6453b51dc8Product, Third Party Advisory
https://etherscan.io/tx/0x5a6c108d5a729be2011cd47590583a04444d4e7c85cd0427071b968edc3bfc1fThird Party Advisory
https://raw.globalsecuritydatabase.org/GSD-2022-1000077Exploit, Third Party Advisory
https://twitter.com/RigoBlock/status/1494351180713050116Exploit, Issue Tracking, Third Party Advisory
https://twitter.com/danielvf/status/1494317265835147272Exploit, Issue Tracking, Third Party Advisory
https://etherscan.io/contractdiffchecker?a1=0x876b9ebd725d1fa0b879fcee12560a6453b51dc8Product, Third Party Advisory
https://etherscan.io/tx/0x5a6c108d5a729be2011cd47590583a04444d4e7c85cd0427071b968edc3bfc1fThird Party Advisory
https://raw.globalsecuritydatabase.org/GSD-2022-1000077Exploit, Third Party Advisory
https://twitter.com/RigoBlock/status/1494351180713050116Exploit, Issue Tracking, Third Party Advisory
https://twitter.com/danielvf/status/1494317265835147272Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Feb 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-253365.3Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows Insecure Direct Object Reference (IDOR) attacks agai CVE-2022-253379.8Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows injection attacks via image filenames.CVE-2022-253386.8ownCloud owncloud/android before 2.20 has Incorrect Access Control for physically proximate attackers.CVE-2022-253395.5ownCloud owncloud/android 2.20 has Incorrect Access Control for local attackers.CVE-2022-25345.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 15.0.5, all versions starting from 15.1 before CVE-2022-253428.1An issue was discovered on Olivetti d-COLOR MF3555 2XD_S000.002.271 devices. The Web Application is affected by Broken Access Control. It do CVE-2022-253437.5An issue was discovered on Olivetti d-COLOR MF3555 2XD_S000.002.271 devices. The Web Application is affected by Denial of Service. An unauth CVE-2022-253446.1An XSS issue was discovered on Olivetti d-COLOR MF3555 2XD_S000.002.271 devices. The Web Application doesn't properly check parameters, sent CVE-2022-253457.5All versions of package @discordjs/opus are vulnerable to Denial of Service (DoS) when trying to encode using an encoder with zero channels,CVE-2022-253477.5Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to path traversal attacks, which may allow an attacker to writ CVE-2022-253487.8Untrusted search path vulnerability in AttacheCase ver.4.0.2.7 and earlier allows an attacker to gain privileges and execute arbitrary code CVE-2022-253495.4All versions of package materialize-css are vulnerable to Cross-site Scripting (XSS) due to improper escape of user input (such as <not-a