CVE-2023-33964

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

mx-chain-go is an implementation of the MultiversX blockchain protocol written in the Go language. Metachain cannot process a cross-shard miniblock. Prior to version 1.4.16, an invalid transaction with the wrong username on metachain is not treated correctly on the metachain transaction processor. This is strictly a processing issue that could have happened on MultiversX chain. If an error like this had occurred, the metachain would have stopped notarizing blocks from the shard chains. The resuming of notarization is possible only after applying a patched binary version. A patch in version 1.4.16 introduces `processIfTxErrorCrossShard` for the metachain transaction processor. There are no known workarounds for this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
May 31, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-339658.8Brook is a cross-platform programmable network tool. The `tproxy` server is vulnerable to a drive-by command injection. An attacker may foolCVE-2023-339669.8Deno is a runtime for JavaScript and TypeScript. In deno 1.34.0 and deno_runtime 0.114.0, outbound HTTP requests made using the built-in `noCVE-2023-339679.8EaseProbe is a tool that can do health/status checking. An SQL injection issue was discovered in EaseProbe before 2.1.0 when using MySQL/PosCVE-2023-339685.4Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to a missinCVE-2023-339695.4Kanboard is open source project management software that focuses on the Kanban methodology. A stored Cross site scripting (XSS) allows an atCVE-2023-33976.3A race condition occurred between the functions lmLogClose and txEnd in JFS, in the Linux Kernel, executed in different threads. This flaw aCVE-2023-339706.5Kanboard is open source project management software that focuses on the Kanban methodology. A vulnerability related to a `missing access conCVE-2023-339715.4Formcreator is a GLPI plugin which allow creation of custom forms and the creation of one or more tickets when the form is filled. A probablCVE-2023-339728.8Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to creaCVE-2023-339737.5RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In vCVE-2023-339745.9RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In vCVE-2023-339759.8RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In v
CVE-2023-33964: High severity, CVSS 7.5 | Vulnix