Is CVE-2022-31198 actively exploited?

No active exploitation of CVE-2022-31198 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2022-31198 be exploited remotely?

Yes. CVE-2022-31198 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2022-31198?

CVE-2022-31198 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2022-31198

HIGH

CVE-2022-31198

CWE-682Published: August 1, 2022· Updated: Jun 17, 2026

7.5

CVSS v3.1

Official Description

OpenZeppelin Contracts is a library for secure smart contract development. This issue concerns instances of Governor that use the module `GovernorVotesQuorumFraction`, a mechanism that determines quorum requirements as a percentage of the voting token's total supply. In affected instances, when a proposal is passed to lower the quorum requirements, past proposals may become executable if they had been defeated only due to lack of quorum, and the number of votes it received meets the new quorum requirement. Analysis of instances on chain found only one proposal that met this condition, and we are actively monitoring for new occurrences of this particular issue. This issue has been patched in v4.7.2. Users are advised to upgrade. Users unable to upgrade should consider avoiding lowering quorum requirements if a past proposal was defeated for lack of quorum.

NVD Source

Technical Analysis

CVE-2022-31198 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 7.5.