7.5high
CVE-2018-10705
The Owned smart contract implementation for Aurora DAO (AURA), an Ethereum ERC20 token, allows attackers to acquire contract ownership beca…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.1%
percentile 65%
Public exploits
0
none known
Summary
The Owned smart contract implementation for Aurora DAO (AURA), an Ethereum ERC20 token, allows attackers to acquire contract ownership because the setOwner function is declared as public. An attacker can then conduct a lockBalances() denial of service attack.
Exploit prediction (EPSS)
1.07% probability of exploitation in the next 30 days, higher than 65% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
References
- peckshield.com /2018/05/03/ownerAnyone/ · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2018-10705
- NVD: CVE-2018-10705
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.