CVE-2022-24738

HIGH
Published Mar 7, 20224y ago · Modified Jun 17, 20262w ago
7.4 CVSS 3.1
High
Find Similar
Published Mar 7, 2022 4y ago
Last Modified Jun 17, 2026 2w ago

Description

Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain unclaimed funds from user addresses. To do this an attacker must create a new chain which does not enforce signature verification and connects it to the target evmos instance. The attacker can use this joined chain to transfer unclaimed funds. Users are advised to upgrade. There are no known workarounds for this issue.

CVSS Details

Base Score
7.4
Exploitability
2.2
Impact
5.2
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability None

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-287 Improper Authentication Authentication

Affected Products 1

VendorProductVersionRange
evmosevmos* <2.0.1

References 3

  • github.com https://github.com/tharsis/evmos/commit/28870258d4ee9f1b8aeef5eba891681f89348f71
    PatchThird Party Advisory
  • github.com https://github.com/tharsis/evmos/releases/tag/v2.0.1
    Release NotesThird Party Advisory
  • github.com https://github.com/tharsis/evmos/security/advisories/GHSA-5jgq-x857-p8xw
    Third Party Advisory

Remediation

  • github.com https://github.com/tharsis/evmos/commit/28870258d4ee9f1b8aeef5eba891681f89348f71
    PatchThird Party Advisory