CVE-2022-25335

HIGH EXPLOITED IN THE WILD

RigoBlock Drago < 2022-02-17 - Incorrect Authorization in setMultipleAllowances

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2022-25335 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).

Description

RigoBlock Dragos through 2022-02-17 lacks the onlyOwner modifier for setMultipleAllowances. This enables token manipulation, as exploited in the wild in February 2022. NOTE: although 2022-02-17 is the vendor's vulnerability announcement date, the vulnerability will not be remediated until a major protocol upgrade occurs.

References (5)

Core 5
Core References
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://twitter.com/RigoBlock/status/1494351180713050116
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://twitter.com/danielvf/status/1494317265835147272
Exploit, Third Party Advisory x_refsource_misc
https://raw.globalsecuritydatabase.org/GSD-2022-1000077

Scores

CVSS v3 7.5
EPSS 0.0126
EPSS Percentile 65.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

VulnCheck KEV 2022-02-18
InTheWild.io 2022-02-18
CWE
CWE-863
Status published
Products (1)
rigoblock/drago < 2022-02-17
Published Feb 18, 2022
Tracked Since Feb 18, 2026