Detections
Analytics
SCA: security update for @openzeppelin/contracts, @openzeppelin/contracts-upgradeable (GHSA-9c22-pwxw-p6hx)
medium Tenable Cloud Security Plugin ID 413185
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- OpenZeppelin Contracts is a library for secure smart contract development. Before version 4.4.1 but after
3.2.0, initializer functions that are invoked separate from contract creation (the most prominent example
being minimal proxies) may be reentered if they make an untrusted non-view external call. Once an
initializer has finished running it can never be re-executed. However, an exception put in place to
support multiple inheritance made reentrancy possible in the scenario described above, breaking the
expectation that there is a single execution. Note that upgradeable proxies are commonly initialized
together with contract creation, where reentrancy is not feasible, so the impact of this issue is believed
to be minor. This issue has been patched, please upgrade to version 4.4.1. As a workaround, avoid
untrusted external calls during initialization. (CVE-2022-39384)
See Also
Plugin Details
Severity: Medium
ID: 413185
Version: Revision 1.5
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 6/1/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 2.8
Percentile: 22.22
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 5.1
Temporal Score: 3.8
Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2022-39384
CVSS v3
Risk Factor: Medium
Base Score: 5.6
Temporal Score: 4.9
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 12/14/2021
Vulnerability Publication Date: 12/14/2021
Reference Information
CVE: CVE-2022-39384
cwe: CWE-665