CVE-2023-30541
Openzeppelin Contracts 3.2.0 – 4.8.3
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-30541 is a medium-severity Interpretation Conflict (CWE-436) vulnerability in Openzeppelin Contracts. Its CVSS base score is 5.3 (Medium).
Operationally, ranked in the top 44% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-1359
Vulnerability Data
OpenZeppelin Contracts is a library for secure smart contract development. A function in the implementation contract may be inaccessible if its selector clashes with one of the proxy's own selectors. Specifically, if the clashing function has a different signature with…
more
incompatible ABI encoding, the proxy could revert while attempting to decode the arguments from calldata. The probability of an accidental clash is negligible, but one could be caused deliberately and could cause a reduction in availability. The issue has been fixed in version 4.8.3. As a workaround if a function appears to be inaccessible for this reason, it may be possible to craft the calldata such that ABI decoding does not fail at the proxy and the function is properly proxied through.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.25 mandates a secure SDLC process with checkpoints, secure coding, testing and training; it does not stop differing interpretations of shared state or inputs between two products from arising or being exploited
A.8.26 only requires that security requirements (including resilience against injections or input controls) be identified and specified during development or acquisition; it does not itself enforce, implement or assure any mechanism that stops an interpretation conflict from being exploitable.
A.8.27 establishes and applies secure-by-design principles (defense-in-depth, least privilege, assume-breach, distrust-external-input, hardening, etc.) but does not stop two products from interpreting the same input or protocol step differently; the resulting state/conflict weakness can still be present and exploitable.
Secure coding standards can enforce canonical input handling and strict protocol compliance to avoid misinterpretation between products.
Security testing can detect and correct cases where one component misinterprets another’s state or messages.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-436, a class-level weakness, and none of its children carries one either.